CVE-2025-60474: MP4Box Buffer Overflow DoS Vulnerability – GPAC Project

Technical summary

CVE-2025-60474 is a stack-based buffer overflow (CWE-121) in the gf_media_import function within /media_tools/av_parsers.c of GPAC Project/MP4Box. The vulnerability stems from insufficient bounds checking when parsing crafted media input, allowing an attacker to overflow a stack buffer. This condition triggers application termination, resulting in a Denial of Service (DoS). The attack surface is network-accessible, requires no privileges, and no user interaction beyond file submission.

Business impact

Organizations using MP4Box in automated media processing pipelines, transcoding services, or batch conversion workflows face availability risks. An attacker could repeatedly submit malicious media files to crash processing queues, delaying legitimate media ingestion and delivery. Video hosting platforms, media asset management systems, and content delivery networks that depend on MP4Box are particularly exposed. The impact is limited to availability; confidentiality and integrity of media data are not compromised.

Affected systems

GPAC Project's MP4Box tool is affected in all versions prior to 26.02.0. The vulnerability is present in the media parsing subsystem, meaning any deployment of MP4Box performing automated media analysis, validation, or conversion is at risk. Systems with MP4Box integrated as a library within custom media processing applications are equally vulnerable. The CVSS vector indicates network accessibility, making remote exploitation possible if MP4Box is exposed through a web service or batch processing API.

Exploitability

Exploitation is straightforward: an attacker crafts a malicious media file with invalid structures that trigger the buffer overflow and supplies it to an MP4Box instance. No special tools, authentication, or user-level privileges are needed. The low attack complexity and network accessibility mean that any service accepting media uploads and using affected MP4Box versions faces real risk. The absence of complexity barriers makes this vulnerability attractive for opportunistic denial-of-service attacks.

Remediation

Upgrade MP4Box to version 26.02.0 or later. Organizations unable to patch immediately should implement input validation and file-type verification upstream of MP4Box processing, restrict MP4Box exposure to trusted internal networks, and consider running MP4Box in sandboxed or containerized environments to limit blast radius if a crash occurs. Monitor for unexpected MP4Box process terminations in production logs.

Patch guidance

Apply the upgrade to GPAC Project version 26.02.0 or newer as soon as feasible. Verify the upgrade addresses this specific buffer overflow in av_parsers.c by consulting the vendor's release notes. If you deploy MP4Box as a containerized service, rebuild images with the patched version and roll out updates through your container orchestration system. For embedded integrations, rebuild your application with the updated GPAC library and conduct regression testing on media samples from your production environment.

Detection guidance

Monitor MP4Box process logs and system error outputs for crash signals, segmentation faults, or unexpected terminations when processing media files. Network-based detection is challenging without deep packet inspection of media streams; focus on behavioral indicators: repeated MP4Box process restarts, latency spikes in media processing pipelines, or queuing backlogs. Implement file integrity monitoring on media input directories to capture anomalous file characteristics before processing. Test detection by submitting known-malicious or malformed media samples to non-production systems and observe logging behavior.

Why prioritize this

Despite the HIGH CVSS score (7.5), this vulnerability poses moderate operational risk in most environments because impact is limited to availability rather than data breach. However, organizations running media processing as a critical service—particularly those monetizing video or operating time-sensitive content delivery—should prioritize patching. The low exploitation barrier means passive monitoring alone is insufficient; proactive patching within 30 days is prudent to avoid opportunistic DoS campaigns.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a remotely exploitable network vulnerability with no user interaction required, resulting in high impact to availability. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) captures that confidentiality and integrity are unaffected, preventing a critical rating. The high availability impact alone—causing application crashes—drives the score into the HIGH band. Organizations should contextualize this as 'high operational impact' rather than 'data breach risk.'

Frequently asked questions