CVE-2025-60468: GPAC MP4Box Heap Use-After-Free Denial of Service

Technical summary

CVE-2025-60468 is a heap use-after-free vulnerability in GPAC's filter_core/filter_pid.c, specifically within the gf_filter_pid_inst_swap_delete_task() function (lines 574–580). During PID (Packet Identifier) instance swap and delete operations, the function fails to properly manage object lifecycle, dereferencing memory that has already been freed. The vulnerability is triggered when processing malformed MPEG-2 TS or MP4 inputs during filter teardown, resulting in undefined behavior and process termination. The root cause stems from improper cleanup sequencing when swapping or deleting PID instances in GPAC's filter pipeline architecture.

Business impact

This vulnerability poses a localized denial-of-service risk to organizations using GPAC/MP4Box for automated media processing pipelines, transcoding workflows, or content ingestion systems. While direct remote exploitation is not possible, authenticated local users or processes running with user privileges can crash processing jobs by submitting crafted media files, disrupting batch operations and potentially blocking time-sensitive media workflows. The impact is contained to availability; no data exposure or system compromise is possible.

Affected systems

GPAC/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master is confirmed affected. This is a development branch; users of stable release versions should verify the upstream GPAC project repository to determine if their deployed version incorporates the vulnerable code path. Organizations using GPAC for server-side media processing, Docker-based transcoding services, or CI/CD media pipeline stages are most directly at risk.

Exploitability

Exploitation requires local system access with authenticated user privileges and the ability to supply a crafted media file to MP4Box for processing. There is no network attack vector; remote attackers cannot trigger this flaw directly. The attack complexity is low—standard media file manipulation techniques can produce inputs that trigger the use-after-free. The likelihood of accidental or intentional exploitation in shared hosting or multi-tenant media processing environments is elevated, particularly where untrusted users can submit media for processing.

Remediation

Monitor the GPAC project repository and official releases for patched versions that address the heap use-after-free in gf_filter_pid_inst_swap_delete_task(). Until patches are available, restrict media processing operations to trusted inputs and implement strict access controls to limit which users can submit files to MP4Box. In high-risk environments, consider running GPAC processing in sandboxed or containerized contexts with resource limits and crash recovery mechanisms. Review your media pipeline's input validation and isolation practices.

Patch guidance

The GPAC project has not yet published a stable release with this fix. Verify the upstream GPAC repository and release notes for version updates addressing heap management in PID instance cleanup. When a patch becomes available, test it thoroughly in a staging environment with your organization's typical media inputs before deployment, as the fix will touch core filter lifecycle management. Check the official GPAC advisories and changelog for confirmation of the resolved commit hash.

Detection guidance

Monitor MP4Box process crashes and unexpected terminations, particularly when correlated with media file processing jobs. System-level indicators include segmentation faults (SIGSEGV) or heap corruption errors in logs related to GPAC filter operations. Implement application-level monitoring of MP4Box return codes and exit signals; repeated crashes from specific input files or file patterns warrant investigation. Consider running GPAC with Address Sanitizer (ASAN) or similar memory debugging tools in staging to catch use-after-free conditions early during testing of new media sources.

Why prioritize this

While this vulnerability carries a medium CVSS score (5.5), its practical impact is limited by the requirement for local access and user authentication, and the attack surface is restricted to organizations running media processing services. However, for teams operating shared media processing infrastructure, transcoding farms, or automated content ingestion systems, the risk is elevated. Prioritize patching if you fit this profile; others may defer until stable patches and clearer guidance become available.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects the availability-only impact (denial of service), low attack complexity, and local attack vector with low privilege requirements. The score appropriately excludes confidentiality and integrity concerns, as the use-after-free does not enable information disclosure or system compromise—only process termination. In real-world context, the score should be adjusted upward if the affected MP4Box instance is a critical service component, or downward if media processing is non-critical or fully isolated from production systems.

Frequently asked questions