What is the CVSS score of CVE-2025-60474?

CVE-2025-60474 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of GPAC MP4Box are affected by CVE-2025-60474?

GPAC's MP4Box media processing tool contains a denial-of-service vulnerability that crashes when processing specially crafted media files.

Is there a public PoC exploit available for CVE-2025-60474?

Yes, a public proof-of-concept exploit is available for CVE-2025-60474. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-60474?

24 hours: Identify all systems running GPAC MP4Box and assess usage in production media workflows. 7 days: Since no vendor-released patch is currently identified, implement file source restrictions, input validation on media files, and process isolation with resource limits (timeouts) to mitigate denial-of-service risk; establish fallback workflows. 30 days: Monitor GPAC security advisories for patches and test deployment when available.

GPAC MP4Box CVE-2025-60474

EUVD-2025-210335 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-24 mitre

GHSA-cqcc-c9q9-x82m

Buffer Overflow Denial Of Service Stack Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

3.3 LOW

A crafted file must be processed by the MP4Box CLI/library, so AV:L and UI:R; impact is a single parser-process crash with no code execution, so C:N/I:N and only A:L.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 14:34 vuln.today

Analysis Generated

Jun 25, 2026 - 14:34 vuln.today

CVSS changed

Jun 25, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Jun 24, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

AnalysisAI

Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by supplying a crafted media file. The flaw is an out-of-bounds read of a language metadata string in gf_media_import (media_import.c), where three characters were read without verifying the string's length. Publicly available exploit code exists (sigdevel PoC), but it is not listed in CISA KEV and EPSS is low (0.19%, 8th percentile), indicating minimal observed real-world exploitation.

Technical ContextAI

GPAC is a widely used open-source multimedia framework; MP4Box is its command-line muxing/packaging utility and libgpac is the underlying library embedded in media pipelines. The root cause (CWE-121, stack-based buffer overflow per NVD, though the patch shows an out-of-bounds read pattern) is in gf_media_import within src/media_tools/media_import.c. The code built a 4CC language code via GF_4CC(p->value.string[0], [1], [2], ' ') from a track's language property string without checking that the string held at least three bytes. A short or malformed language string caused reads past the buffer, corrupting state or crashing the parser. The official fix (commit bd7fd6be) adds a strlen(p->value.string) >= 3 guard before dereferencing those indices.

RemediationAI

Upgrade to GPAC 26.02.0 or later, which contains the fix commit bd7fd6be546e0cd9e599c6b262c338c5f2ecec5c that adds a length check (strlen >= 3) before reading the language metadata string; this is the primary remediation. Because the upstream fix is published as a GitHub commit (https://github.com/gpac/gpac/commit/bd7fd6be546e0cd9e599c6b262c338c5f2ecec5c) tied to issue https://github.com/gpac/gpac/issues/3287, distributors should rebuild against patched libgpac and downstream packagers should pull the release. Until patched, do not run MP4Box/libgpac on untrusted media files; in automated media-processing pipelines, sandbox the importer (run it under a restricted, resource-limited, isolated process such as a container/seccomp jail) so a crash cannot affect the broader service, and validate or restrict the source of input files. The trade-off of sandboxing is added operational complexity and possible throughput overhead, but it contains the DoS to a disposable worker rather than the host service.