CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow ad in gf_ac4_parser_bs on crafted AC-4 stam
Published Oct 20, 2026
·Updated
A buffer overflow in the gfac4parserbs function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
Affected Software
8 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 20, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·10:17 PM
Affected Software
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
GPAC Project MP4Box versions before 2.5 are affected. The issue is in the gf_ac4_parser_bs function in /media_tools/av_parsers.c.
2
What must an attacker provide to trigger the issue?
An attacker needs to supply a crafted input that reaches the vulnerable AC-4 parser function. Successful exploitation can cause a denial of service through a buffer overflow.
3
What is the remediation?
Upgrade MP4Box to version 2.5 or later. The referenced GPAC commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b contains the associated fix.