https://seclists.org/oss-sec/2026/q4/324: CVE-2025-60476: Heap use-after-fe in GPAC/MP4Box AC-4 descriptor cleanup
Affected Software
Frequently Asked Questions
Which builds are known to be affected and fixed?
The issue was reproduced in GPAC 2.5-DEV-rev1593-gfe88c3545-master at commit fe88c3545aadd597b250ccf23271d5d3de50ccc8. The listed fix is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
What does an attacker need to trigger the flaw?
An attacker needs to provide a crafted AC-4 stream containing malformed configuration-list data and have it processed by MP4Box. The CVSS vector indicates user interaction is required, consistent with a user or workflow processing the malicious file.
What is the practical impact of processing a malicious file?
Processing the crafted file can crash MP4Box, causing denial of service. The use-after-free condition is also identified as having potential arbitrary-code-execution impact.
How can the issue be reproduced or investigated?
The reported reproduction uses a GPAC build with AddressSanitizer and runs MP4Box with the -info option on the crafted input. AddressSanitizer reports an eight-byte read from memory that was previously freed during recursive cleanup.