CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup
Published Oct 19, 2026
·Updated
A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Affected Software
8 affected components
Gpac Project MP4Box=2.5-DEV-rev1593-gfe88c3545-master
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 19, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·07:17 PM
Affected Software
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker provide to trigger the issue?
An attacker must supply a crafted AC4 file that is processed by MP4Box.
2
What is the expected impact of successful exploitation?
The reported impact is denial of service caused by a heap use-after-free in gf_odf_ac4_cfg_clean_list.
3
Which build is identified as affected?
The report identifies GPAC Project MP4Box version 2.5-DEV-rev1593-gfe88c3545-master.