A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidxboxread of the file src/isomedia/boxcodebase.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.

Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svgattributes.c, svgparsestrings(), gfsvgparseattribute()

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gfsgvrmlfieldclone() to memcpy from invalid pointers and crash.

An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gfavcchangevui /afltest/gpac/src/mediatools/avparsers.c:6872:55 allows attackers to crash the application.

Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.

GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gfisomparsemovieboxesinternal due to improper return value handling of GFSKIPBOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.

Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to parse a MP4 file, it calls the function diSTboxread() to read from video. In this function, it allocates a buffer str with fixed length. However, content read from bs is controllable by user, so is the length, which causes a buffer overflow.

Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/isomread.c:2807:51 function in gfisomgetuserdata.

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gfxmlparsebitsequencebs function in utils/xmlbincustom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4() and TraverseShape() that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

Motion Spell GPAC contains a null pointer dereference vulnerability that could allow a local attacker to cause a denial-of-service (DoS) condition.

A use-after-free in the gffilterpidinstswapdeletetask function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1687-ge44a4e2b0-master Commit e44a4e2b0d193566619ada71599e70255699da94 Fixed: 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 CVE: CVE-2025-60492 CWE: CWE-674 (Uncontrolled Recursion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CISA assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box can exhaust its process stack while decoding a crafted MPEG-4 BIFS scene. Deeply nested scene nodes cause repeated calls among gfbifsdecnode(), BDDecMFFieldList(), gfbifsdecfield(), and gfbifsdecnodelist() without an effective recursion-depth limit.

The issue was reproduced in GPAC version 2.5-DEV-rev1687-ge44a4e2b0-master at commit e44a4e2b0d193566619ada71599e70255699da94.

Impact: Exporting the crafted scene exhausts the process stack and terminates MP4Box, resulting in denial of service. Arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -x3d 59AnchorCreatescenegraphmpeg4nodesc171

ASan log excerpt: ==4071400==ERROR: AddressSanitizer: stack-overflow on address 0x7ffec640bac8 #6 in gfbifsdecnode bifs/fielddecode.c:905 #7 in BDDecMFFieldList bifs/fielddecode.c:330 #8 in gfbifsdecfield bifs/fielddecode.c:569 #9 in gfbifsdecnodelist bifs/fielddecode.c:631 #10 in gfbifsdecnode bifs/fielddecode.c:933

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59AnchorCreatescenegraphmpeg4nodesc171

References: https://github.com/gpac/gpac/issues/3324 https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 https://www.cve.org/CVERecord?id=CVE-2025-60492 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60492.json https://infosec.exchange/@sigdevel/117456655329648201

—— Best regards, Alexander A. Shvedov @sigdevel

A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gfm2tsdecodeait of the file src/mediatools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.

A heap buffer overflow in the gfisomvpconfignew function (isomedia/avcext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap use-after-free in the gfnodegettag function (scenegraph/basescenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap use-after-free in the gfnodegettag function (scenegraph/basescenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the gfisomcopysampleinfo function (isomedia/isomwrite.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A stack overflow in the gfopusreadlength function (mediatools/avparsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the gfmediamapesd function (mediatools/isomtools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

An Out-of-Memory in the mp4muxcencinsertpssh function (filters/muxisom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap buffer overflow in the gfopusparsepacketheader function (mediatools/avparsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the TrackSetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap buffer overflow in the gfcencsetpssh function (isomedia/drmsample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A use-after-free in the gffilterpidreconfiguretaskdiscard function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filtercore/filterpid.c (L:574-580): function gffilterpidinstswapdeletetask() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gffilterpidinstswapdeletetask() in filtercore/filterpid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.

A buffer overflow in the gfmediaimport function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

A use-after-free in the gffilterpidgetpacket function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A use-after-free in the gfseiloadfromstateinternal function (/filters/seiload.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.