CVE-2025-60475: Buffer Overflow

Q: Which deployments are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the gf_ac4_parser_bs function in /media_tools/av_parsers.c.

Q: What must an attacker provide to trigger the issue?

An attacker needs to supply a crafted input that reaches the vulnerable AC-4 parser function. Successful exploitation can cause a denial of service through a buffer overflow.

Q: What is the remediation?

Upgrade MP4Box to version 2.5 or later. The referenced GPAC commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b contains the associated fix.

Published Oct 20, 2026

Updated

A buffer overflow in the gfac4parserbs function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 20, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:17 PM

Description

Frequently Asked Questions

Which deployments are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the gf_ac4_parser_bs function in /media_tools/av_parsers.c.

What must an attacker provide to trigger the issue?

An attacker needs to supply a crafted input that reaches the vulnerable AC-4 parser function. Successful exploitation can cause a denial of service through a buffer overflow.

What is the remediation?

Upgrade MP4Box to version 2.5 or later. The referenced GPAC commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b contains the associated fix.

CVE-2025-60475: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker provide to trigger the issue?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker provide to trigger the issue?

What is the remediation?