https://seclists.org/oss-sec/2026/q4/395: CVE-2025-60467: GPAC/MP4Box: Use-After-Fe in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file

Q: Who is exposed to this issue?

Systems or workflows that use MP4Box to inspect MPEG-2 TS files from untrusted sources are exposed. Exploitation requires a user or process to provide the crafted file to MP4Box.

Q: Does exploitation require authentication or elevated privileges?

No. The attacker needs only the ability to supply a crafted MPEG-2 TS file; no authentication or special privileges are required.

Q: What is the expected impact of successful exploitation?

The reported outcome is a heap use-after-free that crashes the MP4Box process, causing denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

Q: How can I determine whether my source tree is affected?

The affected scope is gpac/gpac prior to the referenced fix commit. The issue was reproducible on the current master branch at the time of discovery; the provided data does not identify a fixed release version.

Published Oct 26, 2026

Updated

Affected Software

1 affected component

Gpac GPAC (MP4Box)<26.07.0

Frequently Asked Questions

Who is exposed to this issue?

Systems or workflows that use MP4Box to inspect MPEG-2 TS files from untrusted sources are exposed. Exploitation requires a user or process to provide the crafted file to MP4Box.

Does exploitation require authentication or elevated privileges?

No. The attacker needs only the ability to supply a crafted MPEG-2 TS file; no authentication or special privileges are required.

What is the expected impact of successful exploitation?

The reported outcome is a heap use-after-free that crashes the MP4Box process, causing denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

How can I determine whether my source tree is affected?

The affected scope is gpac/gpac prior to the referenced fix commit. The issue was reproducible on the current master branch at the time of discovery; the provided data does not identify a fixed release version.