PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-60485 GPAC Project CVE debrief

A segmentation violation in the gf_isom_apple_set_tag_ex function within GPAC Project/MP4Box allows remote attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability exists in /isomedia/isom_write.c and affects versions before 26.02.0. The issue was addressed in a commit to the GPAC repository.

Vendor
GPAC Project
Product
MP4Box
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations using GPAC Project/MP4Box for MP4 media processing, including media encoding pipelines, content delivery networks, and multimedia analysis tools, should prioritize patching to prevent service disruption from malicious file uploads or processing.

Technical summary

The vulnerability is a segmentation violation in the gf_isom_apple_set_tag_ex function located in /isomedia/isom_write.c of the GPAC multimedia framework, specifically affecting the MP4Box tool. An attacker can trigger a Denial of Service by providing a maliciously crafted MP4 file that causes an invalid memory access during tag processing. The issue was resolved in GPAC version 26.02.0 through a code commit that addresses the underlying memory safety defect.

Defensive priority

medium

Recommended defensive actions

  • Upgrade GPAC Project/MP4Box to version 26.02.0 or later to remediate this vulnerability.
  • Validate and sanitize MP4 file inputs before processing with MP4Box in environments where immediate patching is not feasible.
  • Monitor for anomalous MP4 processing failures that may indicate exploitation attempts.
  • Review application logs for unexpected crashes in media processing pipelines using GPAC/MP4Box.

Evidence notes

The CVE description identifies a segmentation violation in gf_isom_apple_set_tag_ex in /isomedia/isom_write.c of GPAC Project/MP4Box before 26.02.0, triggered by a crafted MP4 file. The fix commit and issue tracker reference confirm vendor acknowledgment and remediation.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-60485 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-60485

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-60485 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-60485

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.