GPAC MP4Box CVE-2025-60491

Exploitation requires the victim to locally process an attacker-crafted MP4 file with GPAC/MP4Box's DASH segmenter (the dasher filter), which reaches dasher_flush_segment; this maps to AV:L plus UI:R - a human or automated pipeline must actually ingest the malicious file. There is no network-triggerable path and no authentication prerequisite, but exploitation is limited to versions before 2.5 and yields only a Denial of Service (A:H, C:N/I:N). The precise structural trigger beyond the stale set->udta pointer corrected in commit f6128214 is not further detailed in the available sources. Limiting factors for defenders: requires MP4Box to be used on untrusted input, affects only pre-2.5 builds, and impact is confined to process crash rather than data compromise.

This is a genuinely moderate-to-low priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, user-interaction-dependent flaw with availability-only impact - there is no confidentiality or integrity loss and no network reachability, so this is a crash/DoS primitive triggered when MP4Box processes a malicious file, not a remotely exploitable RCE. The EPSS score of 0.21% (10th percentile) corroborates low expected exploitation, and the vulnerability is NOT in CISA KEV, so there is no public_exploit identified at time of analysis as actively exploited. A public PoC reference exists; it is not verified as working exploit code, which raises reproducibility but not necessarily reliable weaponization. The vuln.today decision label is 'this_month' - a routine patch cadence, not an emergency. The main caveat: CWE-416 use-after-free bugs can sometimes escalate beyond DoS to memory disclosure or code execution, but the supplied evidence (commit diff plus description) characterizes impact strictly as Denial of Service, so treating this as code-execution-capable would overstate what the sources confirm. Net: real but non-urgent; prioritize for the monthly patch window.

An attacker crafts a malicious MP4 file and delivers it to a victim who processes it locally with GPAC/MP4Box (e.g., in a media conversion or DASH-packaging pipeline or by manual invocation). When MP4Box reaches dasher_flush_segment, a dangling pointer to a freed segment/adaptation-set structure is reused, crashing the process and denying service. A public PoC reference exists; it is not verified as working exploit code, and exploitation requires the victim to open the attacker-supplied file (UI:R).