CVE-2025-60497: Gpac Project MP4Box vulnerability

Q: Who is exposed to this denial-of-service issue?

Systems using GPAC Project MP4Box versions before 2.5 are affected when they process attacker-supplied MP4 files. The available information identifies the vulnerable code as the GetESD function in /isomedia/track.c.

Q: What does an attacker need to exploit the issue?

An attacker needs to supply a crafted MP4 file for MP4Box to process. Successful exploitation can cause a denial of service through a segmentation violation.

Q: How can I remediate the issue?

Upgrade MP4Box to version 2.5 or later. The issue is fixed by the referenced GPAC commit 91083fcfce01aa596a13a6962768d13a60bfc8bb.

Published Oct 21, 2026

Updated

A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Affected Software

1 affected component

Gpac Project MP4Box<2.5

Event History

Oct 21, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Systems using GPAC Project MP4Box versions before 2.5 are affected when they process attacker-supplied MP4 files. The available information identifies the vulnerable code as the GetESD function in /isomedia/track.c.

What does an attacker need to exploit the issue?

An attacker needs to supply a crafted MP4 file for MP4Box to process. Successful exploitation can cause a denial of service through a segmentation violation.

How can I remediate the issue?

Upgrade MP4Box to version 2.5 or later. The issue is fixed by the referenced GPAC commit 91083fcfce01aa596a13a6962768d13a60bfc8bb.

CVE-2025-60497: Gpac Project MP4Box vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit the issue?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What does an attacker need to exploit the issue?

How can I remediate the issue?