CVE-2025-60492 GPAC Project CVE debrief

Who should care

Defenders responsible for systems utilizing GPAC Project/MP4Box should assess exposure and verify the version in use. This includes operators, security teams, and vulnerability management teams. They should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files. The vulnerability has a high impact on the system's availability, and defenders should take immediate action to mitigate the vulnerability.

Why it matters

CVE-2025-60492 is a stack overflow vulnerability in GPAC Project/MP4Box before version 2.5, allowing for potential Denial of Service (DoS) attacks via crafted MP4 files. Defenders should verify the version in use and assess exposure.

• Potential Denial of Service (DoS) attacks
• Need for version verification of GPAC Project/MP4Box
• Possible disruption of service due to crafted MP4 files

Technical summary

The gf_bifs_dec_node function in GPAC Project/MP4Box before version 2.5 is vulnerable to a stack overflow attack. This can be exploited by supplying a crafted MP4 file, potentially leading to a Denial of Service (DoS). The vulnerability is caused by improper handling of a crafted MP4 file, which can lead to a stack overflow and potentially allow attackers to execute arbitrary code. Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files. The vulnerability has a high impact on the system's availability.

Defensive priority

Defenders should prioritize verifying the version of GPAC Project/MP4Box in use and assessing exposure to crafted MP4 files.

Recommended defensive actions

• Verify the version of GPAC Project/MP4Box in use
• Assess exposure to crafted MP4 files
• Consider upgrading to version 2.5 or later of GPAC Project/MP4Box
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in GPAC Project/MP4Box before version 2.5 and the potential for a Denial of Service (DoS) attack. The vulnerability is caused by improper handling of a crafted MP4 file, which can lead to a stack overflow. Defenders should verify the version in use and assess exposure to crafted MP4 files. The source item provides additional context on the vulnerability, including its potential impact on the system's availability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.