GPAC MP4Box CVE-2025-60490

Exploitation requires a victim to process an attacker-supplied crafted MP4 file using GPAC/MP4Box before version 2.5 (UI:R, AV:L) - there is no network-facing attack surface. The trigger is a use-after-free of a PID instance that is about to be removed during a filter chain swap, reached while sending a downstream event; the fix simply skips the event when pid_inst->swap_source is set. Limiting factors that reduce real-world risk: it is local only and needs user/pipeline action to parse the malicious file, impact is availability-only (process crash, no code execution or data disclosure claimed), and it is fully resolved by updating to GPAC 2.5. Upstream provides the patch/version update as the fix; no separate workaround is stated in the evidence.

This is a genuinely moderate, low-urgency issue rather than a priority emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, availability-only flaw: the attacker cannot reach it over the network and must get a victim to process a crafted MP4 file (UI:R). Impact is confined to a crash of the GPAC/MP4Box process (C:N/I:N/A:H) - no confidentiality or integrity loss is claimed. The exploitation signals reinforce low real-world urgency: EPSS is 0.17% (6th percentile), the vuln.today decision label is 'this_month' (not act_now/emergency), and there is no CISA KEV listing, so this is not confirmed as actively exploited. A public PoC reference exists (github-poc link) but it is not verified as working exploit code, so POC availability must not be read as active exploitation. No conflicts between the signals - they consistently point to a legitimate but non-critical DoS. One caveat: the input labels CWE-122 (heap-based buffer overflow) while the description specifies a heap use-after-free; the underlying fixed code (skipping an event for a PID instance being removed during chain swap) is consistent with a use-after-free, so treat the CWE label as approximate.

An attacker crafts a malformed MP4 file and gets a victim to process it with a vulnerable GPAC/MP4Box build (before 2.5), e.g. in a media-conversion or packaging pipeline. Parsing triggers a use-after-free of a PID instance during filter chain teardown, crashing the process and denying service. A public PoC reference exists but is not verified as working exploit code, and no active exploitation is confirmed.