https://seclists.org/oss-sec/2026/q4/409: CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow ad in gf_ac4_parser_bs on crafted AC-4 stam

Q: Who is exposed to this issue?

Systems using GPAC/MP4Box to inspect or probe AC-4 input are exposed if an attacker can provide a crafted AC-4 stream or file. No authentication or special privileges are required beyond supplying the malicious file.

Q: What is the expected impact of successful exploitation?

The reported impact is a process crash and denial of service. The invalid frame_rate_index causes a 4-byte out-of-bounds read past the AC4_SAMPLE_DELTA_TABLE_48 global array during input probing.

Q: How can I tell whether a workflow is affected?

A vulnerable MP4Box build can crash while probing a crafted AC-4 file through ac4dmx_probe_data(). The issue was reproducible on the reported master-branch build, 2.5-DEV-rev1593-gfe88c3545-master.

Published Oct 27, 2026

Updated

Affected Software

1 affected component

Gpac MP4Box<26.07.0

Frequently Asked Questions

Who is exposed to this issue?

Systems using GPAC/MP4Box to inspect or probe AC-4 input are exposed if an attacker can provide a crafted AC-4 stream or file. No authentication or special privileges are required beyond supplying the malicious file.

What is the expected impact of successful exploitation?

The reported impact is a process crash and denial of service. The invalid frame_rate_index causes a 4-byte out-of-bounds read past the AC4_SAMPLE_DELTA_TABLE_48 global array during input probing.

How can I tell whether a workflow is affected?

A vulnerable MP4Box build can crash while probing a crafted AC-4 file through ac4dmx_probe_data(). The issue was reproducible on the reported master-branch build, 2.5-DEV-rev1593-gfe88c3545-master.