CVE-2025-60466: GPAC MP4Box Use-After-Free DoS Vulnerability

Technical summary

CVE-2025-60466 is a use-after-free vulnerability in the gf_filter_pid_get_packet function located in /filter_core/filter_pid.c within GPAC's multimedia processing framework. When processing a crafted media file, the function attempts to dereference a pointer to memory that has already been freed, violating memory safety guarantees. This memory corruption occurs within the filter chain's packet handling routine, which is central to media transcoding and analysis workflows. The vulnerability is classified under CWE-416 (Use After Free) and carries a CVSS 3.1 score of 5.0 (Medium severity) with a local attack vector, low attack complexity, and impact limited to availability.

Business impact

Organizations relying on GPAC MP4Box for media ingestion, transcoding, or automated file processing face service disruption risk. Unpatched systems could experience unexpected crashes when processing untrusted media files, potentially halting batch jobs, streaming workflows, or content analysis pipelines. While confidentiality and integrity are not compromised, the availability impact may disrupt business-critical media operations, particularly in broadcast, post-production, or content distribution environments where reliability is essential.

Affected systems

The vulnerability affects GPAC Project's MP4Box component in all versions prior to 26.02.0. GPAC is commonly embedded in media processing toolchains and is used by developers integrating multimedia capabilities into larger applications. Both standalone MP4Box deployments and applications using GPAC libraries are in scope. Verify your specific deployment against the 26.02.0 release timeline and confirm which GPAC version your media handling infrastructure runs.

Exploitability

Exploitation requires local file system access and user interaction—an attacker must supply a crafted media file that is then opened or processed by a user or automated system running vulnerable MP4Box. Remote exploitation over a network is not directly possible. However, in scenarios where media files are automatically ingested from untrusted sources (cloud storage, user uploads, feed aggregators), the barrier to triggering the crash is low. The attack complexity is minimal once a malicious file reaches a vulnerable system.

Remediation

Upgrade GPAC MP4Box to version 26.02.0 or later. This version addresses the use-after-free condition in the filter packet handling logic. Organizations unable to upgrade immediately should implement input validation and sandboxing: restrict MP4Box processing to trusted media sources, run the tool in isolated containers or virtual machines, and monitor for unexpected process terminations that may signal exploitation attempts.

Patch guidance

Apply GPAC version 26.02.0 or newer. Verify the patch through official GPAC Project release channels and confirm the version in your deployment (command: mp4box -version or check embedded library version in dependent applications). For organizations with extensive media processing infrastructure, test the patched version in a staging environment before rolling out to production to ensure compatibility with existing workflows and third-party integrations.

Detection guidance

Monitor for abnormal MP4Box or GPAC process terminations, particularly when processing files from external or untrusted sources. Implement logging of media file submissions and correlate unexpected exits with file ingestion events. Examine system memory dumps if available to detect segmentation faults in gf_filter_pid.c. Network-based detection is limited due to the local attack vector; focus on endpoint and application-level monitoring. Consider network-based file integrity checks to identify malformed media files before processing.

Why prioritize this

This vulnerability merits near-term patching despite its medium CVSS score because availability impact in media processing is operationally significant, the attack surface spans any system accepting untrusted media files, and the fix is straightforward (version upgrade). Organizations running automated or batch media workflows should prioritize this patch. However, if MP4Box runs only on isolated development or testing systems with controlled input, remediation can be deferred slightly in favor of higher-severity threats.

Risk score, explained

The CVSS 3.1 score of 5.0 reflects the vulnerability's limited scope (local access required, user interaction needed) but accounts for the definite availability impact (service crash). The score does not account for contextual risk: organizations processing untrusted media at scale face elevated practical risk compared to isolated development use. The vulnerability is neither remotely exploitable nor a privilege escalation vector, which keeps the base score in the medium range.

Frequently asked questions