GPAC MP4Box CVE-2025-60480

Exploitation requires a local user to open or process an attacker-supplied, specially crafted AC4 audio file with a vulnerable MP4Box/GPAC build (AV:L, UI:R); it cannot be triggered remotely or without victim action. The specific trigger is an AC4 alternative_info structure whose name_len meets/exceeds the presentation_name array length, or whose n_targets meets/exceeds the target_md_compat/target_device_category array lengths, causing an out-of-bounds heap write. Limiting factors: no authentication is needed (PR:N) but mandatory user interaction and local file delivery substantially narrow realistic attack surface, and impact is confined to process crash (availability only) with no confidentiality or integrity effect in the provided data.

This is a genuine but low-priority vulnerability. The provided CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores it 5.5 (Medium) and is internally consistent with the description: AV:L plus UI:R means exploitation requires a local user to open or process an attacker-supplied AC4 file - this is file-parsing, not a network-reachable service. The impact is availability-only (A:H, with C:N/I:N), matching the stated Denial of Service outcome; there is no confirmed code-execution path (CWE-122 heap overflow can sometimes escalate, but no such claim appears in the data). EPSS is 0.22% (12th percentile), consistent with a low-value crash bug in a parsing library, and there is NO CISA KEV listing. No SSVC decision data was provided. The source-code evidence (fix commit e02d1fd) confirms the root cause - missing bounds checks on name_len/n_targets before writing into fixed-size arrays - so the vulnerability is real and verified, but the signals uniformly point to low real-world urgency: a DoS-only crash requiring local user interaction with a malicious file.

An attacker crafts a malformed AC4 audio file with manipulated alternative-info fields (name_len or n_targets exceeding the fixed array bounds) and delivers it to a victim via email, download, or a media-processing pipeline. When the victim opens or converts the file with a vulnerable MP4Box/GPAC build, the heap buffer overflow in gf_odf_ac4_cfg_alternative_info corrupts memory and crashes the process. Exploitation requires local user interaction (UI:R, AV:L); no public exploit code is identified in the provided data, though a public GitHub issue (#3295) documents the flaw.