CVE-2025-60465: GPAC MP4Box Use-After-Free Denial of Service Vulnerability

Technical summary

CVE-2025-60465 is a use-after-free flaw (CWE-416) in the gf_filter_pid_inst_swap function within GPAC's filter_core/filter_pid.c module. The vulnerability permits an unauthenticated, local attacker to cause a denial-of-service condition by supplying a crafted media file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) reflects local attack surface, low attack complexity, user interaction requirement (opening a file), and impacts on confidentiality and integrity within the application scope. The score of 6.1 (MEDIUM severity) indicates moderate risk. Notably, GPAC is widely used in video streaming, transcoding, and media analysis pipelines.

Business impact

For organizations relying on GPAC or MP4Box for media ingestion, transcoding, or validation workflows, this vulnerability can disrupt service availability. If a media processing pipeline automatically processes user-submitted or third-party video files, an attacker can introduce a crafted file to crash the processor, causing queued jobs to fail and potentially impacting video delivery timelines. The integrity impact component suggests potential for subtle corruption of processed media or internal state, warranting investigation. Organizations in broadcast, streaming, content delivery, and digital asset management face the highest operational risk.

Affected systems

GPAC Project and MP4Box versions prior to 26.02.0 are vulnerable. The flaw resides in media filter processing, affecting any deployment of GPAC or MP4Box that handles untrusted media input. This includes command-line usage of MP4Box for media analysis or conversion, as well as library integration in third-party applications that parse or process MP4 and related container formats. Verify your installed version against the vendor's release notes.

Exploitability

Exploitability is straightforward in scenarios where an attacker can supply a media file to a victim or target system. No special privileges, authentication, or network access are needed. The user interaction requirement—opening or processing the file—is easily satisfied in typical media workflows where files are automatically ingested from upload directories, email attachments, or cloud storage. The attack does not appear in any public exploit databases, but the low complexity and simple prerequisites mean proof-of-concept development is likely feasible. The vulnerability is not listed as in-the-wild exploitation as of the last KEV update.

Remediation

Upgrade GPAC and MP4Box to version 26.02.0 or later. If immediate patching is not feasible, apply input validation and sandboxing controls: restrict MP4Box and media processing to isolated sandboxes or containers with limited filesystem and memory access; implement file-type whitelisting and signature validation before processing; and disable automatic media processing of untrusted sources pending patch deployment. Organizations should test patched versions in non-production environments first to ensure compatibility with existing media pipelines.

Patch guidance

Download and deploy GPAC version 26.02.0 or newer from the official GPAC project repository (github.com/gpac/gpac). Review the project's release notes and changelog for any breaking changes or behavioral updates affecting your integration. If using MP4Box as a standalone tool, update via the project's download page or your Linux distribution's package manager once the patched version is available upstream. Verify the update by running 'MP4Box -version' or checking the library's version via your application's dependency management system.

Detection guidance

Monitor media processing logs for segmentation faults, crashes, or abnormal terminations of MP4Box or GPAC-based services, particularly when processing new or unusual media files. Implement integrity checks on incoming files before processing: scan for file format anomalies using tools like 'file' or 'ffprobe'. Network-level detection is limited since the attack requires local file processing; focus on endpoint telemetry. In automated pipelines, log the source and hash of every file processed; correlate crashes with specific file uploads to identify attack patterns. Consider honeypot media files with known malicious properties to detect reconnaissance or active exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability warrants prompt attention because: (1) GPAC is pervasive in media infrastructure and widely integrated into streaming platforms and broadcasters; (2) the attack surface is broad—any system accepting user-submitted or third-party video files is at risk; (3) operational disruption from repeated denial-of-service attacks can accumulate; and (4) the integrity impact suggests potential for subtle data corruption that may not be immediately noticed. Organizations with public-facing media upload or processing services should prioritize this patch within 30 days.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: local attack vector (AV:L), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction needed (UI:R). While the confidentiality impact (C:L) and integrity impact (I:H) are present, the availability impact is absent (A:N), preventing a higher score. In practice, denial-of-service conditions reduce availability indirectly. The score appropriately balances the accessibility of the attack against its limited scope—application-level crash rather than system-wide compromise. Organizations handling untrusted media should treat this as a higher priority within their own risk context.

Frequently asked questions