CVE-2025-60491: heap use-after-fe in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
Published Oct 21, 2026
·Updated
A heap use-after-free in the dasherflushsegment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
8 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
GPAC Project MP4Box versions before 2.5 are affected. The issue is in the dasher_flush_segment function in filters/dasher.c.
2
What does exploitation require?
An attacker needs to supply a crafted MP4 file for MP4Box to process. The documented impact is denial of service caused by a heap use-after-free.
3
What should be done if the affected version cannot be upgraded immediately?
Do not process untrusted MP4 files with affected MP4Box versions. Restrict MP4 inputs to trusted sources until an upgrade to version 2.5 or later is possible.