CVE-2025-60492: uncontrolled cursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
Published Oct 21, 2026
·Updated
A stack overflow in the gfbifsdecnode function (/bifs/fielddecode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
8 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
debian/gpac
Event History
Oct 21, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·03:17 PM
Affected Software
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
MP4Box installations from GPAC versions before 2.5 are affected when they process attacker-supplied crafted MP4 files.
2
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted MP4 file that is processed by MP4Box. The described impact is denial of service through a stack overflow in gf_bifs_dec_node.
3
How can I determine whether an installation is affected?
Check the installed GPAC/MP4Box version. Versions before 2.5 are within the affected range described.