CVE-2025-60475 GPAC Project CVE debrief

Who should care

Defenders responsible for systems using GPAC Project/MP4Box versions before 2.5 should assess exposure and consider upgrading to version 2.5 or later. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM, indicating a medium priority for systems using GPAC Project/MP4Box versions before 2.5. Defenders should verify the version of GPAC Project/MP4Box in use and consider upgrading to version 2.5 or later to mitigate the vulnerability.

Why it matters

CVE-2025-60475 is a buffer overflow vulnerability in GPAC Project/MP4Box before version 2.5, allowing for potential Denial of Service (DoS) attacks. Defenders should assess exposure, verify versions in use, and consider upgrading to mitigate the vulnerability.

• Potential Denial of Service (DoS) due to buffer overflow vulnerability
• Need to verify GPAC Project/MP4Box versions in use
• Possible upgrade to version 2.5 or later to mitigate vulnerability

Technical summary

The gf_ac4_parser_bs function in the av_parsers.c file of GPAC Project/MP4Box before version 2.5 is vulnerable to a buffer overflow attack. This can be exploited by supplying a crafted input, potentially leading to a Denial of Service (DoS). The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The vulnerability is caused by a lack of proper bounds checking in the gf_ac4_parser_bs function, which can lead to a buffer overflow. Defenders should assess exposure and consider upgrading to version 2.5 or later to mitigate the vulnerability.

Defensive priority

Medium priority for systems using GPAC Project/MP4Box versions before 2.5

Recommended defensive actions

• Assess exposure of GPAC Project/MP4Box versions before 2.5 in your environment
• Verify if your systems are using the vulnerable version of GPAC Project/MP4Box
• Consider upgrading to GPAC Project/MP4Box version 2.5 or later if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and NVD entry provide information about the vulnerability. However, details about affected versions and potential exploits are limited. The vulnerability is confirmed to exist in GPAC Project/MP4Box before version 2.5. Defenders should verify the version of GPAC Project/MP4Box in use and consider upgrading to version 2.5 or later. The CVE record was published on 2026-10-20T22:17:42.747Z and has not been modified since then. The NVD entry provides additional information about the vulnerability, including its CVSS score.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.