CVE-2025-60491: Use After Free

Q: Which deployments are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the dasher_flush_segment function in filters/dasher.c.

Q: What does exploitation require?

An attacker needs to supply a crafted MP4 file for MP4Box to process. The documented impact is denial of service caused by a heap use-after-free.

Q: What should be done if the affected version cannot be upgraded immediately?

Do not process untrusted MP4 files with affected MP4Box versions. Restrict MP4 inputs to trusted sources until an upgrade to version 2.5 or later is possible.

Published Oct 21, 2026

Updated

A heap use-after-free in the dasherflushsegment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are affected?

GPAC Project MP4Box versions before 2.5 are affected. The issue is in the dasher_flush_segment function in filters/dasher.c.

What does exploitation require?

An attacker needs to supply a crafted MP4 file for MP4Box to process. The documented impact is denial of service caused by a heap use-after-free.

What should be done if the affected version cannot be upgraded immediately?

Do not process untrusted MP4 files with affected MP4Box versions. Restrict MP4 inputs to trusted sources until an upgrade to version 2.5 or later is possible.

CVE-2025-60491: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does exploitation require?

What should be done if the affected version cannot be upgraded immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does exploitation require?

What should be done if the affected version cannot be upgraded immediately?