A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isomintern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function MediaGetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
A segmentation violation in the gfisomapplesettagex function (/isomedia/isomwrite.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A NULL pointer dereference in the gfodfac4cfgdsiv1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A segmentation violation in the gfmediagetcolorinfo function (/mediatools/isomtools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
A NULL pointer dereference in the gfac4presb4backchannelspresent function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A heap use-after-free in the dasherprocess function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
A heap buffer overflow in the m2tsdmxsendpacket function (filters/dmxm2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the component MP4Box. This manipulation of the argument naluoutbs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
A use-after-free in the gffilterpidinstswap function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind() function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
A NULL pointer dereference in the gffilterinparentchain function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
A use-after-free in the gffilterpidinstswapdeletetask function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
A use-after-free in the gffilterpidreconfiguretaskdiscard function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60473 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterinparentchain() function in GPAC's filter session core (filtercore/filterpid.c:2145) walks the filter parent chain to determine whether a given filter is an ancestor of another, and is called during PID initialization from gffilterpidinittask(). When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors, reused PIDs, and malformed PES headers that produce an abnormal PID chain state, the function is reached with a NULL or uninitialized parent filter pointer.
The function dereferences the parent pointer without validating it, attempting a READ at address 0x000000000008 (null+0x8 field offset), resulting in a segmentation fault and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 36gffilterinparentchainfiltercorefilterpidc2145
Asan-log: ==2015443==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f7ec2e52c65 bp 0x519000016d80 sp 0x7fffe9ee7390 T0) ==2015443==The signal is caused by a READ memory access. #0 0x7f7ec2e52c65 in gffilterinparentchain filtercore/filterpid.c:2145 #1 0x7f7ec2e7a796 in gffilterpidinittask filtercore/filterpid.c:4932 #2 0x7f7ec2ec3465 in gffsthreadproc filtercore/filtersession.c:2420
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36gffilterinparentchainfiltercorefilterpidc2145
References: https://github.com/gpac/gpac/issues/3285 https://www.cve.org/CVERecord?id=CVE-2025-60473 https://infosec.exchange/@sigdevel/116780471059317580
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60466 CWE: CWE-825 (Expired Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidgetpacket() function in GPAC's filter session core (filtercore/filterpid.c:6827) retrieves the next available packet from a filter PID for processing by downstream filters such as the inspect filter. When MP4Box inspects a crafted MPEG-2 TS file with corrupted PMT descriptors and abnormal PCR discontinuities that drive the pipeline through PID deletion and re-enqueue paths, gffilterpiddel() frees the 336-byte PID instance at filtercore/filterpid.c:5933.
The inspect filter subsequently calls gffilterpidgetpacket() on the invalidated PID without checking whether the PID object has been released, performing a READ of 8 bytes at address 0x513000002dc0 (start of the freed allocation) and crashing the process (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 35gffilterpidgetpacketfiltercorefilterpidc6827
Asan-log: ==1994506==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000002dc0 at pc 0x7fdaa268b8b7 bp 0x7fff42a43b80 sp 0x7fff42a43b78 READ of size 8 at 0x513000002dc0 thread T0 #0 0x7fdaa268b8b6 in gffilterpidgetpacket filtercore/filterpid.c:6827 #1 0x7fdaa2906374 in inspectprocess filters/inspect.c:5218 #2 0x7fdaa26ef401 in gffilterprocesstask filtercore/filter.c:3180
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/35gffilterpidgetpacketfiltercorefilterpidc6827
References: https://github.com/gpac/gpac/issues/3284 https://www.cve.org/CVERecord?id=CVE-2025-60466 https://infosec.exchange/@sigdevel/116780402249845037
—— Best regards, Alexander A. Shvedov @sigdevel
GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filtercore/filterpid.c (L:574-580): function gffilterpidinstswapdeletetask() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gffilterpidinstswapdeletetask() in filtercore/filterpid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60464 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gfseiloadfromstateinternal() function in GPAC's SEI loader (filters/seiload.c:225) processes Supplemental Enhancement Information payloads embedded in HEVC and VVC bitstreams transported over MPEG-2 TS. When MP4Box inspects a crafted TS file containing HEVC/VVC streams with malformed NAL units and corrupted PMT descriptors, the NALU demuxer naludmxconfigurepid() frees the codec state buffer at filters/reframenalu.c:370 during PID reconfiguration.
The function subsequently reads 1 byte from the freed 529,176-byte codec state region at address 0x7f7518dceb04 (529,156 bytes inside the freed allocation) without validating whether the buffer has been released, resulting in a heap-use-after-free and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 32filtersseiloadc225ingfseiloadfromstateinternal
Asan-log: ==33468==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f7518dceb04 at pc 0x7f751b19dbf5 bp 0x7ffc77f69500 sp 0x7ffc77f694f8 READ of size 1 at 0x7f7518dceb04 thread T0 #0 0x7f751b19dbf4 in gfseiloadfromstateinternal filters/seiload.c:225 #1 0x7f751b19dbf4 in gfseiloadfromstate filters/seiload.c:265 #2 0x7f751b0ffd02 in naludmxfinalizeauflags filters/reframenalu.c:2360
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/32/32filtersseiloadc225ingfseiloadfromstateinternal
References: https://github.com/gpac/gpac/issues/3278 https://www.cve.org/CVERecord?id=CVE-2025-60464 https://infosec.exchange/@sigdevel/116778370895014131
—— Best regards, Alexander A. Shvedov @sigdevel
A heap buffer overflow in the gfisomvpconfignew function (isomedia/avcext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A stack overflow in the gfopusreadlength function (mediatools/avparsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A segmentation violation in the TrackSetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elngboxread of the file src/isomedia/boxcodebase.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.
A NULL pointer dereference in the gfisomgetuserdatacount function (isomedia/isomread.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A NULL pointer dereference in the cttsboxwrite function (isomedia/boxcodebase.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfopusparsepacketheader function (mediatools/avparsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
A NULL pointer dereference in the gfodfvvccfgwritebs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap use-after-free in the gfnodegettag function (scenegraph/basescenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.