CVE-2025-60494: Gpac Project MP4Box vulnerability

Q: Which deployments are exposed to this issue?

GPAC Project MP4Box versions before 2.5 are affected. Exposure requires processing a crafted data file.

Q: What does an attacker need to exploit the vulnerability?

An attacker needs to supply a crafted data file that reaches gf_props_equal_internal in filter_core/filter_props.c. Successful exploitation causes a segmentation violation and denial of service.

Published Oct 20, 2026

Updated

A segmentation violation in the gfpropsequalinternal function (/filtercore/filterprops.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 20, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:17 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

GPAC Project MP4Box versions before 2.5 are affected. Exposure requires processing a crafted data file.

What does an attacker need to exploit the vulnerability?

An attacker needs to supply a crafted data file that reaches gf_props_equal_internal in filter_core/filter_props.c. Successful exploitation causes a segmentation violation and denial of service.

CVE-2025-60494: Gpac Project MP4Box vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the vulnerability?