CVE-2025-60478: Heap use-after-fe in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file
Published Oct 21, 2026
·Updated
A use-after-free in the gffilterpacketdestroy function (/filtercore/filterpck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
Affected Software
8 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What input is required to trigger the issue?
An attacker must supply a crafted MPEG-2 file for MP4Box to process.
2
What is the impact of successful exploitation?
Successful exploitation can cause a denial of service through a use-after-free in gf_filter_packet_destroy.
3
Which versions are affected?
GPAC Project MP4Box versions before 2.5 are affected.