CVE-2025-60494: invalid memory ad in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input
Published Oct 20, 2026
·Updated
A segmentation violation in the gfpropsequalinternal function (/filtercore/filterprops.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
Affected Software
7 affected components
Gpac MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
Event History
Oct 20, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via OSV·10:17 PM
Affected Software
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed to this issue?
GPAC Project MP4Box versions before 2.5 are affected. Exposure requires processing a crafted data file.
2
What does an attacker need to exploit the vulnerability?
An attacker needs to supply a crafted data file that reaches gf_props_equal_internal in filter_core/filter_props.c. Successful exploitation causes a segmentation violation and denial of service.