CVE-2025-60464: GPAC MP4Box Use-After-Free DoS Vulnerability

Technical summary

CVE-2025-60464 is a use-after-free vulnerability (CWE-416) in the gf_sei_load_from_state_internal function within /filters/sei_load.c of GPAC Project versions prior to 26.02.0. The vulnerability occurs during parsing of SEI (Supplemental Enhancement Information) data in MPEG-2 TS containers. The affected code fails to properly manage object lifecycle, resulting in dereferenced pointers to freed memory when processing specially crafted files. This leads to application termination and denial of service. The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector with user interaction required, but with broad impact across confidentiality, integrity, and availability.

Business impact

Organizations relying on MP4Box for automated media transcoding, content analysis, or format conversion workflows face service disruption. A successful attack halts processing pipelines until the vulnerable instance is restarted. For media platforms, streaming services, or content delivery networks using GPAC components, this creates operational risk and potential SLA impacts. The vulnerability requires user interaction (opening a file), limiting exposure in fully automated server environments but presenting risk in systems accepting user-supplied media files.

Affected systems

GPAC Project MP4Box versions before 26.02.0 are affected. GPAC is widely embedded in media processing applications, video players, and streaming platforms. The vulnerability specifically impacts systems that parse MPEG-2 TS files containing SEI data through the vulnerable function. Both command-line MP4Box users and applications linking against the GPAC library are in scope. The attack surface is limited to systems that accept external media files as input.

Exploitability

Exploitation requires a crafted MPEG-2 TS file and user interaction to process that file through MP4Box. The attacker cannot trigger the vulnerability remotely without the victim actively opening or processing a malicious file. The attack does not grant code execution; impact is limited to denial of service. No publicly disclosed exploit code or active exploitation in the wild is reported. While the technical barrier is moderate (crafting a malicious TS file), practical impact requires social engineering or file smuggling into trusted workflows.

Remediation

Upgrade GPAC Project to version 26.02.0 or later. Organizations should verify vendor advisories for any interim patches released for older supported versions. Until patching is complete, implement file validation and filtering to reject suspicious MPEG-2 TS files, and isolate MP4Box processing in sandboxed environments where feasible. Consider restricting user ability to submit arbitrary media files directly to processing systems.

Patch guidance

Apply updates to GPAC Project as soon as they become available from the official project repository. Verify the patched version number against official release notes at the GPAC Project website. Organizations using GPAC as an embedded library should check their application vendor for updated builds incorporating the patched GPAC version. Test patches in non-production environments to ensure compatibility with existing media processing workflows before full deployment.

Detection guidance

Monitor for MP4Box or GPAC-based application crashes when processing MPEG-2 TS files, particularly with unusual or malformed SEI headers. Implement input validation to flag suspicious MPEG-2 TS structures. Log file processing failures and correlate with specific file submissions. Intrusion detection systems should flag attempts to deliver crafted MPEG-2 TS files to systems running vulnerable GPAC versions. Review application logs for segmentation faults or memory access violations during media parsing.

Why prioritize this

Prioritize remediation based on your media processing workflow exposure. Organizations accepting external MPEG-2 TS files—particularly in user-facing services—should treat this as moderate-to-high priority despite the denial-of-service-only impact. If your infrastructure processes only internally sourced media or uses alternative video libraries, priority can be lowered. The CVSS 7.8 score and ease of triggering (crafted file) warrant rapid patching in exposed environments.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a use-after-free with local attack vector and user interaction requirement. While confidentiality, integrity, and availability are all marked as high impact, the practical effect is denial of service (availability loss). The local-only nature and user-interaction requirement prevent remote mass exploitation. The score appropriately captures the severity for affected organizations but acknowledges that exploitation barriers exist.

Frequently asked questions