CVE-2025-60491 GPAC Project CVE debrief

Who should care

Defenders responsible for systems using GPAC Project/MP4Box should assess exposure and verify the version in use. This includes operators, security teams, and vulnerability management teams. They should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files to mitigate potential risks.

Why it matters

CVE-2025-60491 is a heap use-after-free vulnerability in GPAC Project/MP4Box before 2.5, allowing for potential Denial of Service (DoS) attacks via crafted MP4 files. Defenders should verify the version in use and assess exposure.

• Potential Denial of Service (DoS) via crafted MP4 files
• Need to verify GPAC Project/MP4Box version and exposure

Technical summary

The dasher_flush_segment function in GPAC Project/MP4Box before 2.5 is vulnerable to a heap use-after-free attack. This can be exploited by supplying a crafted MP4 file, potentially leading to a Denial of Service (DoS). The vulnerability is caused by a use-after-free error in the dasher_flush_segment function, which can be triggered by a specially crafted MP4 file. The vulnerability has a high impact on the system's availability, and defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files.

Defensive priority

Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files.

Recommended defensive actions

• Verify the version of GPAC Project/MP4Box in use
• Assess exposure to crafted MP4 files
• Consider upgrading to version 2.5 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide information on the vulnerability, but details on affected versions and potential exploits are limited. The vulnerability is confirmed to exist in GPAC Project/MP4Box before version 2.5. Defenders should verify the version in use and assess exposure to crafted MP4 files. The source references provide additional context, but more information may be needed to fully understand the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.