CVE-2025-60480: Buffer Overflow
Published Oct 19, 2026
·Updated
A heap buffer overflow in the gfodfac4cfgalternativeinfo function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
8 affected components
Gpac Project MP4Box=2.5-DEV-rev1593-gfe88c3545-master
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 19, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·06:16 PM
Affected Software
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is exploitation known to allow code execution or data disclosure?
The provided information identifies denial of service as the impact. It does not claim code execution or data disclosure.
2
Is a fix identified in the available information?
The references include an upstream GPAC commit, but the provided data does not specify which MP4Box releases include that change.