https://seclists.org/oss-sec/2026/q4/352: CVE-2025-60491: heap use-after-fe in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input
Affected Software
Frequently Asked Questions
Which deployments are exposed to this issue?
Systems that use MP4Box to process attacker-supplied or otherwise untrusted MPEG-2 Transport Stream files are exposed. The reported vulnerable build is GPAC 2.5-DEV-rev1698-gfc2009fa7-master at commit fc2009fa75631960743f8f7855dda8998167b5ab.
What does an attacker need to exploit the vulnerability?
An attacker needs to provide a crafted MPEG-2 Transport Stream that is processed by MP4Box with DASH segmentation, as demonstrated with the -dash 1000 option. The CVSS vector indicates network delivery is possible with low attack complexity, no privileges, and user interaction required.
What should be done if an affected build is in use?
Update to a build containing fix commit f6128214feb69cd689e4b9944a2621bc4ad8faf0. Until updating, avoid processing untrusted MPEG-2 Transport Stream input with the affected MP4Box DASH workflow.
How can I determine whether my build is affected?
Check the GPAC source revision used to build MP4Box. The issue was reproduced at commit fc2009fa75631960743f8f7855dda8998167b5ab; builds that include f6128214feb69cd689e4b9944a2621bc4ad8faf0 contain the reported fix.