CVE-2025-60492: Gpac MP4Box vulnerability

Q: Which deployments are exposed?

MP4Box installations from GPAC versions before 2.5 are affected when they process attacker-supplied crafted MP4 files.

Q: What does an attacker need to exploit this issue?

The attacker needs to supply a crafted MP4 file that is processed by MP4Box. The described impact is denial of service through a stack overflow in gf_bifs_dec_node.

Q: How can I determine whether an installation is affected?

Check the installed GPAC/MP4Box version. Versions before 2.5 are within the affected range described.

Published Oct 21, 2026

Updated

A stack overflow in the gfbifsdecnode function (/bifs/fielddecode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Affected Software

1 affected component

Gpac MP4Box<2.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

MP4Box installations from GPAC versions before 2.5 are affected when they process attacker-supplied crafted MP4 files.

What does an attacker need to exploit this issue?

The attacker needs to supply a crafted MP4 file that is processed by MP4Box. The described impact is denial of service through a stack overflow in gf_bifs_dec_node.

How can I determine whether an installation is affected?

Check the installed GPAC/MP4Box version. Versions before 2.5 are within the affected range described.

CVE-2025-60492: Gpac MP4Box vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

How can I determine whether an installation is affected?