https://seclists.org/oss-sec/2026/q4/325: CVE-2025-60478: Heap use-after-fe in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file
Affected Software
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use MP4Box to process untrusted MPEG-2 transport-stream files during DASH segmentation are exposed. The CVSS vector indicates local attack access and user interaction are required, meaning an attacker would need a user or automated workflow to process the crafted file.
What conditions are needed to trigger the vulnerability?
The input must be a crafted MPEG-2 TS file with malformed PMT/PAT data and an empty DASH segment state. The reported reproduction invokes MP4Box with DASH segmentation using the -dash 100 option.
Which builds are known to be affected and fixed?
The issue was reproduced in GPAC 2.5-DEV-rev1617-g856674b22-master, at commit 856674b226d6cbe28a941ad223be38194cbf7d37. The listed fix is commit c592a144bbe339ee581ca88aaa3247362795b742.
How can I check whether my environment is affected?
Compare the GPAC source revision in use with the reported affected commit and verify whether the listed fix commit is included. The issue can be detected during the provided DASH-segmentation reproduction when GPAC is built with AddressSanitizer.