CVE-2025-60467: GPAC MP4Box Use-After-Free DoS Vulnerability

Technical summary

CVE-2025-60467 is a use-after-free (UAF) vulnerability in the gf_filter_pid_inst_swap_delete_task function within GPAC's filter_core/filter_pid.c module. When processing certain media files, the function fails to properly manage memory references during filter instance deletion, allowing an attacker to trigger access to already-freed memory. This results in undefined behavior and process termination, constituting a denial-of-service condition. The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH severity) due to its network-exploitable attack surface, lack of authentication requirements, and direct impact on availability.

Business impact

Organizations using GPAC/MP4Box for media processing pipelines face service disruption risks. If MP4Box processes user-supplied or untrusted media files—such as in transcoding services, media analysis platforms, or automated content ingestion workflows—a crafted file can crash the service. This can interrupt legitimate media operations, cause cascading failures in dependent services, and require manual intervention to restart affected systems. The impact is primarily operational availability rather than data confidentiality or integrity breach.

Affected systems

GPAC Project's MP4Box library and tools before version 26.02.0 are affected. Any software embedding GPAC or directly using the filter framework for multimedia processing inherits this risk. Common deployments include media servers, transcoding engines, content analysis tools, and multimedia SDKs integrated into streaming platforms or broadcast infrastructure.

Exploitability

Exploitability is straightforward: no authentication, privileges, or user interaction are required. An attacker needs only to deliver a specially crafted media file to a vulnerable instance. If the instance processes untrusted media from network sources, web uploads, or third-party feeds, the attack surface is direct. However, the vulnerability requires the specific code path to be exercised, which depends on the filter configuration used during media processing.

Remediation

Upgrade GPAC/MP4Box to version 26.02.0 or later. Verify the upgrade with your distribution or vendor, as backports may be available for older supported branches. Until patching is complete, restrict MP4Box processing to trusted media sources and consider sandboxing or containerizing the service to limit blast radius.

Patch guidance

Apply the patch by upgrading to GPAC version 26.02.0 or newer. Consult the official GPAC Project repository and release notes for verification. If your deployment uses a wrapper or integration library, verify that the underlying GPAC dependency is also updated. Test the patched version in a staging environment to ensure media processing workflows remain functional before deploying to production.

Detection guidance

Monitor for unexpected MP4Box or GPAC filter process crashes, particularly those coinciding with media file uploads or submissions. Log file analysis may reveal segmentation faults or memory access violations. Network-based detection is challenging absent application-level logging; focus on application-level signals. Consider collecting process exit codes and core dumps when available. In high-volume media processing environments, a sudden spike in process crashes correlated with specific file submissions may indicate exploitation attempts.

Why prioritize this

Despite a HIGH CVSS score, this vulnerability does not appear on the KEV catalog and is not currently exploited in the wild. However, the ease of exploitation and the direct availability impact warrant rapid patching in environments processing untrusted media. Prioritize based on whether your deployment processes external or user-submitted files; internal-only use cases can follow a standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects network accessibility (AV:N), low attack complexity (AC:L), no authentication (PR:N), no user interaction (UI:N), uniform scope (S:U), and high availability impact (A:H). The lack of confidentiality and integrity damage prevents a critical rating. The score is appropriate for a denial-of-service condition in a widely-used multimedia framework, but risk in your environment depends on whether untrusted media reaches vulnerable instances.

Frequently asked questions