GPAC MP4Box CVE-2025-60471
MEDIUMSeverity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file processing with no privileges needed; user must open the file; DoS-only with no C or I impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
AnalysisAI
Use-after-free in GPAC MP4Box before version 26.02.0 allows a local attacker to crash the application by supplying a crafted media file, resulting in Denial of Service. The flaw resides in the filter PID lifecycle management within filter_pid.c, where a PID instance could be freed prematurely while a pending reconfiguration task still held a reference to it. Publicly available exploit code exists, though the attack requires user interaction to process the malicious file and exploitation is limited to DoS with no confidentiality or integrity impact.
Technical ContextAI
GPAC is an open-source multimedia framework and the MP4Box tool is its command-line interface for MP4 file manipulation and media processing. The vulnerability (CWE-416: Use After Free) exists in the filter pipeline subsystem, specifically in the gf_filter_pid_reconfigure_task_discard function at filter_core/filter_pid.c line 1341. The commit diff (868c6801) reveals the root cause: gf_filter_pid_inst_swap_delete unconditionally called gf_filter_pid_inst_del to free a PID instance even when a configure_task_discard task had already been posted for that PID (signaled by discard_inputs==2). When the queued task later executed, it accessed the already-freed PID instance memory, triggering undefined behavior and a crash. The fix introduces a deferred destruction pattern using a discard_inputs state machine (value 2 = task pending, 3 = to be destroyed by task) to coordinate safe teardown across the asynchronous task boundary. CPE data provided is non-informative (n/a:n/a); affected product is confirmed as GPAC/MP4Box pre-26.02.0 per the CVE description and referenced GitHub issue.
RemediationAI
The primary fix is to upgrade GPAC MP4Box to version 26.02.0 or later, which incorporates the upstream patch at commit 868c6801c226e9964cace54cfd5a759f152780b4. The patch is available at https://github.com/gpac/gpac/commit/868c6801c226e9964cace54cfd5a759f152780b4; however, a formally tagged released version has not been independently confirmed beyond the CVE description's reference to 26.02.0 as the fixed version. If upgrading immediately is not possible, a practical compensating control is to restrict MP4Box from processing untrusted or externally sourced media files - specifically, preventing automated pipelines from ingesting files from untrusted sources without prior validation or sandboxing. Running MP4Box in a sandboxed environment (e.g., via seccomp, containers, or AppArmor) can limit the blast radius of a crash to the isolated process. Since impact is DoS-only with no privilege escalation, restricting the tool's network access or filesystem write permissions provides no additional protection for this specific vulnerability.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-416 – Use After Free
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today