Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 (GPAC version 2.5-DEV-rev1665-g3f20eb0cd-master) CVE: CVE-2025-60486 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The dasherconfigurepid function in filters/dasher.c frees a PID context structure at line 976 when reconfiguring a stream during DASH segmentation. The freed pointer is not cleared after deallocation, and dasherprocess subsequently accesses the same memory region at line 9445 during the next processing cycle, creating a heap use-after-free condition.
A crafted MPEG-2 TS file with repeated sync marker violations, broken PMT descriptor sizes, and conflicting PID assignments triggers the reconfiguration sequence that exposes the stale pointer. The subsequent READ of 4 bytes at 316 bytes into the freed 1096-byte region terminates the process. Code execution cannot be ruled out; use-after-free vulnerabilities can allow an attacker to control freed memory contents and redirect execution flow.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -dash 100 53dasherprocessfiltersdasherc9445
Asan-log: ==55065==ERROR: AddressSanitizer: heap-use-after-free on address 0x519000022cbc at pc 0x7f2fc41c3300 bp 0x7ffe86651b00 sp 0x7ffe86651af8 ==55065==The signal is caused by a READ memory access. #0 0x7f2fc41c32ff in dasherprocess filters/dasher.c:9445 #1 0x7f2fc4119440 in gffilterprocesstask filtercore/filter.c:3208 #2 0x7f2fc40ed45e in gffsthreadproc filtercore/filtersession.c:2393
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/53/53dasherprocessfiltersdasherc9445
References: https://github.com/gpac/gpac/issues/3314 https://nvd.nist.gov/vuln/detail/CVE-2025-60486 https://www.cve.org/CVERecord?id=CVE-2025-60486
--- Best regards, Alexander A. Shvedov https://github.com/sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (74fecde32cd477ab097f3e6db55a32b259f3313d) CVE: CVE-2025-55652 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: When MP4Box runs a DASH segmentation on a crafted MP4 file containing malformed VP codec configuration data in the stsd box (including an unknown D0ncv box type), gfisomvpconfignew() in isomedia/avcext.c does not sufficiently validate buffer boundaries when allocating the VP codec configuration box.
The function allocates an undersized 88-byte box structure and then writes VP/NALU configuration data beyond it. AddressSanitizer reports a heap-buffer-overflow WRITE of size 8 at isomedia/avcext.c:1962, 136 bytes after the 88-byte heap region, reached via mp4muxsetuppid() while MP4Box sets up the PID for the crafted track during DASH segmentation.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -dash 10000 ./18poc.mp4
Asan-log: ==4147309==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x508000003180 at pc 0x55cc296f3879 bp 0x7ffda97c9590 sp 0x7ffda97c9588 WRITE of size 8 at 0x508000003180 thread T0 #0 0x55cc296f3878 in gfisomvpconfignew isomedia/avcext.c:1962 #1 0x55cc2a01734f in mp4muxsetuppid filters/muxisom.c:2895 #2 0x55cc29beb268 in gffilterpidconfigure filtercore/filterpid.c:919
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/18/18poc.mp4
References: https://github.com/gpac/gpac/issues/3242 https://www.cve.org/CVERecord?id=CVE-2025-55652 https://infosec.exchange/@sigdevel/116736829161374790
—— Best regards, Alexander A. Shvedov https://github.com/sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (ff8249a407685d00ceb5f4d2a798b9cad195140e) CVE: CVE-2025-55662 CWE: CWE-369 (Divide by Zero) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: When MP4Box dumps a crafted MP4 file containing an Opus audio track with malformed packet/header parameters, gfopusparsepacketheader() in mediatools/avparsers.c fails to verify that critical Opus packet fields such as nbframes are valid before using them in arithmetic.
The function computes a value such as max = header->nbframes - 1 and uses it without checking that nbframes is non-zero, leading to a division by zero / invalid arithmetic that AddressSanitizer reports as an FPE at mediatools/avparsers.c:11479, reached via the Opus dump path while MP4Box processes the crafted MP4.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 2poc.mp4 -dxml -out /dev/null
Asan-log: ==21635==ERROR: AddressSanitizer: FPE on unknown address 0x7ff46116e8f9 (pc 0x7ff46116e8f9 bp 0x502000002b10 sp 0x7ffc49282d60 T0) #0 0x7ff46116e8f9 in gfopusparsepacketheader mediatools/avparsers.c:11479 #1 0x7ff4618ce40f in gfinspectdumpopusinternal filters/inspect.c:1830 #2 0x5610acd70b66 in dumpisomopus /home/user/target/mp4boxdyn/gpacasan/gpac/applications/mp4box/filedump.c:1501
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/2/2poc.mp4
References: https://github.com/gpac/gpac/issues/3159 https://www.cve.org/CVERecord?id=CVE-2025-55662 https://infosec.exchange/@sigdevel/116710224797830572
—— Best regards, Alexander A. Shvedov https://github.com/sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (ff8249a407685d00ceb5f4d2a798b9cad195140e) CVE: CVE-2025-55661 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 5.4 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: When MP4Box dumps a crafted MP4 file containing a malformed Opus audio packet (e.g. an invalid TOC code 3 length), gfopusparsepacketheader() in mediatools/avparsers.c does not sufficiently validate the input buffer size before reading Opus packet header fields.
AddressSanitizer reports a heap-buffer-overflow at mediatools/avparsers.c:11326, a READ of size 1 immediately after a 3-byte heap region allocated by MediaGetSample(), reached via gfinspectdumpopusinternal() while MP4Box dumps the crafted Opus track. The out-of-bounds read may also disclose adjacent heap memory.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box 9poc.mp4 -dxml -out /dev/null
Asan-log: ==26920==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000001a13 at pc 0x7efd1656ed0b bp 0x7ffcecc3c420 sp 0x7ffcecc3c418 READ of size 1 at 0x502000001a13 thread T0 #0 0x7efd1656ed0a in gfopusparsepacketheader mediatools/avparsers.c:11326 #1 0x7efd16cce40f in gfinspectdumpopusinternal filters/inspect.c:1830 #2 0x55836b659b66 in dumpisomopus /home/user/target/mp4boxdyn/gpacasan/gpac/applications/mp4box/filedump.c:1501
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/9/9poc.mp4
References: https://github.com/gpac/gpac/issues/3160 https://www.cve.org/CVERecord?id=CVE-2025-55661 https://infosec.exchange/@sigdevel/116733907390103029
—— Best regards, Alexander A. Shvedov https://github.com/sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (8a0d5b43c242fe4befb88530e4c9afef37114161) CVE: CVE-2025-52293 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: 5.4 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: When MP4Box imports and splits a crafted MP4 file containing a malformed HEVC track, gfhevcreadspsbsinternal() in mediatools/avparsers.c reads SPS fields from the HEVC NAL bitstream without sufficiently validating the bitstream bounds for the crafted SPS data.
AddressSanitizer reports a SEGV caused by a READ memory access at mediatools/avparsers.c:9309, reached via gfhevcreadspsex() during NAL/config replacement while MP4Box processes the crafted file (address 0x00000007c018).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 3poc.mp4 -new /dev/null -split-size 5000000
Asan-log: ==134142==ERROR: AddressSanitizer: SEGV on unknown address 0x00000007c018 (pc 0x7f2e8935d6b5 bp 0x000000000007 sp 0x7ffcefe27c10 T0) ==134142==The signal is caused by a READ memory access. #0 0x7f2e8935d6b5 in gfhevcreadspsbsinternal mediatools/avparsers.c:9309 #1 0x7f2e8935ff38 in gfhevcreadspsex mediatools/avparsers.c:9597 #2 0x7f2e89b3061c in isorpsgetid filters/isoffinreadch.c:712
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/3/3poc.mp4
References: https://github.com/gpac/gpac/issues/3146 https://www.cve.org/CVERecord?id=CVE-2025-52293 https://infosec.exchange/@sigdevel/116710484148913883
—— Best regards, Alexander A. Shvedov https://github.com/sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60471 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidreconfiguretaskdiscard() function in GPAC's filter session core (filtercore/filterpid.c:1341) handles cleanup of filter PID reconfiguration tasks during media import. When MP4Box processes a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid packet streams, the filter session schedules a PID reconfiguration that triggers deallocation of a pidinst structure via gffilterpidinstswapdelete() in filtercore/filterpid.c:540.
The function subsequently accesses the already-freed 336-byte pidinst region at address 0x513000000580 without validating whether the instance has been released, resulting in a heap-use-after-free on a READ of 8 bytes at that address and potential arbitrary code execution.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341
Asan-log: ==26772==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000580 at pc 0x7fe607a8b95d bp 0x7fff9793a4b0 sp 0x7fff9793a4a8 READ of size 8 at 0x513000000580 thread T0 #0 0x7fe607a8b95c in gffilterpidreconfiguretaskdiscard filtercore/filterpid.c:1341 #1 0x7fe607ac2f65 in gffsthreadproc filtercore/filtersession.c:2420 #2 0x7fe607ac81c4 in gffsrun filtercore/filtersession.c:2727
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/31/31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341
References: https://github.com/gpac/gpac/issues/3279 https://www.cve.org/CVERecord?id=CVE-2025-60471 https://infosec.exchange/@sigdevel/116778301425195980
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60474 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gfmediaimport() function in GPAC's media import layer (mediatools/mediaimport.c:1297) imports media tracks from input files into the filter processing pipeline. When MP4Box inspects a crafted MPEG-2 TS file, the function stores a property value that was produced by strdup(""), allocating a 1-byte heap buffer containing only the NUL terminator at address 0x502000003110.
The function subsequently reads 1 byte at offset [1] of this buffer (past its only valid index [0]) at address 0x502000003111, triggering a heap-buffer-overflow read and crashing the process (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 38gfmediaimportmediatoolsmediaimportc1297
Asan-log: ==2016054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003111 at pc 0x7f11ecdaca1e bp 0x7fffd1145a00 sp 0x7fffd11459f8 READ of size 1 at 0x502000003111 thread T0 #0 0x7f11ecdaca1d in gfmediaimport mediatools/mediaimport.c:1297 #1 0x558a953c08e3 in convertfileinfo /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/fileimport.c:131 #2 0x558a953914b7 in mp4boxmain /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/mp4box.c:6520
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/38/38gfmediaimportmediatoolsmediaimportc1297
References: https://github.com/gpac/gpac/issues/3287 https://www.cve.org/CVERecord?id=CVE-2025-60474 https://infosec.exchange/@sigdevel/116780566799952592
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60465 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidinstswap() function in GPAC's filter session core (filtercore/filterpid.c:633) swaps PID instance references during PID reconfiguration. When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid stream configurations, the function frees the ctx->pidinst structure (a 336-byte allocation) at filtercore/filterpid.c:716 inside gffilterpidconfigure() but does not reset the pointer to NULL afterwards.
A subsequent code path within the same reconfiguration call dereferences the now-dangling ctx->pidinst pointer, performing a READ of 8 bytes at address 0x513000000598 (24 bytes inside the freed region), resulting in a heap-use-after-free and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 34gffilterpidinstswapfiltercorefilterpidc633
Asan-log: ==1992184==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000598 at pc 0x7f2c95a88277 bp 0x7ffd4ffcb9e0 sp 0x7ffd4ffcb9d8 READ of size 8 at 0x513000000598 thread T0 #0 0x7f2c95a88276 in gffilterpidinstswap filtercore/filterpid.c:633 #1 0x7f2c95a88276 in gffilterpidconfigure filtercore/filterpid.c:919 #2 0x7f2c95a89a22 in gffilterpidconnecttask filtercore/filterpid.c:1311
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/34/34gffilterpidinstswapfiltercorefilterpidc633
References: https://github.com/gpac/gpac/issues/3283 https://www.cve.org/CVERecord?id=CVE-2025-60465 https://infosec.exchange/@sigdevel/116778494176930561
—— Best regards, Alexander A. Shvedov @sigdevel