PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-60478 GPAC Project CVE debrief

A use-after-free vulnerability in GPAC Project/MP4Box before version 2.5 allows for Denial of Service (DoS) attacks via a crafted MPEG-2 file. This issue, tracked as CVE-2025-60478, was made public on October 21, 2026, and the CVE record was last modified on October 26, 2026. The vulnerability is located in the gf_filter_packet_destroy function within the /filter_core/filter_pck.c file.

Vendor
GPAC Project
Product
MP4Box
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-26
Advisory published
2026-10-21
Advisory updated
2026-10-26

Who should care

Defenders responsible for systems utilizing GPAC Project/MP4Box should assess exposure and verify the version in use, focusing on input validation and sanitization for MPEG-2 file processing. This includes reviewing system inventories, assessing potential impact, and implementing necessary mitigations or updates. Security teams should also review monitoring and detection capabilities to identify potential exploitation attempts.

Why it matters

CVE-2025-60478 is a use-after-free vulnerability in GPAC Project/MP4Box before version 2.5, allowing for Denial of Service (DoS) attacks. Defenders should verify the version in use and assess exposure to crafted MPEG-2 files.

  • Potential Denial of Service (DoS) attacks via crafted MPEG-2 files
  • Need to verify GPAC Project/MP4Box version and implement input validation

Technical summary

The vulnerability is a use-after-free issue in the gf_filter_packet_destroy function of GPAC Project/MP4Box before version 2.5. This allows attackers to cause a Denial of Service (DoS) via a crafted MPEG-2 file. The issue arises from improper handling of memory, leading to potential crashes or unexpected behavior when processing maliciously crafted files. Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MPEG-2 files, focusing on input validation and sanitization.

Defensive priority

Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MPEG-2 files.

Recommended defensive actions

  • Verify the version of GPAC Project/MP4Box in use
  • Assess exposure to crafted MPEG-2 files
  • Implement input validation and sanitization for MPEG-2 file processing
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its location in the gf_filter_packet_destroy function and the potential for DoS attacks. However, specific version details and remediation steps are limited. Defenders should verify the version in use and assess exposure to crafted MPEG-2 files, focusing on input validation and sanitization for MPEG-2 file processing.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-60478 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-60478

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-60478 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60478

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2025-60478

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60478.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/gpac/gpac/issues/3300

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/README.md

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://infosec.exchange/@sigdevel/117456560052551246

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.