CVE-2025-60482: Use After Free
Published Oct 19, 2026
·Updated
A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
1 affected component
Gpac Project MP4Box=2.5-DEV-rev1593-gfe88c3545-master
Event History
Oct 19, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:17 PM
Description
Frequently Asked Questions
1
What must an attacker provide to trigger the issue?
An attacker must supply a crafted AC4 file that is processed by MP4Box.
2
What is the expected impact of successful exploitation?
The reported impact is denial of service caused by a heap use-after-free in gf_odf_ac4_cfg_clean_list.
3
Which build is identified as affected?
The report identifies GPAC Project MP4Box version 2.5-DEV-rev1593-gfe88c3545-master.