CVE-2025-60476: Heap use-after-fe in GPAC/MP4Box AC-4 descriptor cleanup
A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that process AC4 files with affected GPAC MP4Box versions before 2.5 are exposed, particularly where untrusted or externally supplied media files are handled.
What does an attacker need to exploit it?
An attacker needs to supply a crafted AC4 file to an affected MP4Box instance. The documented impact is denial of service through a heap use-after-free condition.
How can I determine whether I am affected?
Check whether MP4Box is part of your media-processing workflow and whether its GPAC version is earlier than 2.5. Review inputs and job failures involving AC4 files for crashes or service interruption.
What can be done if upgrading is not immediately possible?
Avoid processing untrusted AC4 files with the affected MP4Box installation. Restrict AC4 ingestion to trusted sources until the software can be updated.