https://seclists.org/oss-sec/2026/q4/353: CVE-2025-60492: uncontrolled cursion in GPAC/MP4Box BIFS decoder via crafted MP4 input
Affected Software
Frequently Asked Questions
Who is most likely to be exposed to this issue?
The reported impact applies to MP4Box users who export crafted MP4 content containing MPEG-4 BIFS scenes. The advisory does not identify impacts on other GPAC components or use cases.
What must an attacker or malicious file cause a user to do?
A user or operator must process the crafted input with MP4Box; the provided reproduction uses the -x3d export option. The CVSS vector also indicates user interaction is required.
What can be done while a fix is being deployed?
Avoid exporting untrusted MP4 files containing MPEG-4 BIFS scenes with MP4Box, particularly through the -x3d workflow. The reported outcome is process termination from stack exhaustion, not demonstrated code execution.
How can I determine whether my build is implicated?
The issue was reproduced in GPAC 2.5-DEV-rev1687-ge44a4e2b0-master at commit e44a4e2b0d193566619ada71599e70255699da94. The advisory identifies commit 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 as the fix.