CVE-2025-60497 GPAC Project CVE debrief

Who should care

Defenders of GPAC Project/MP4Box deployments should assess exposure to potential Denial of Service (DoS) attacks via crafted MP4 files. This includes reviewing current GPAC Project/MP4Box versions and updating to version 2.5 or later if necessary. Security teams and operators managing GPAC Project/MP4Box need to prioritize this vulnerability for immediate review and potential remediation.

Why it matters

CVE-2025-60497 is a segmentation violation vulnerability in GPAC Project/MP4Box that allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. Defenders of GPAC Project/MP4Box deployments should assess exposure to potential Denial of Service (DoS) attacks via crafted MP4 files and review and update GPAC Project/MP4Box to version 2.5 or later.

• Potential Denial of Service (DoS) attacks via crafted MP4 files
• Need to assess GPAC Project/MP4Box deployments for exposure
• Need to review and update GPAC Project/MP4Box to version 2.5 or later

Technical summary

A segmentation violation in the GetESD function of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The vulnerability is located in the track.c file of the GPAC Project/MP4Box source code. Defenders should assess exposure of GPAC Project/MP4Box deployments to potential Denial of Service (DoS) attacks via crafted MP4 files. The vulnerability has a high impact on service availability and requires immediate review of GPAC Project/MP4Box versions for updates.

Defensive priority

Assess exposure of GPAC Project/MP4Box deployments to potential Denial of Service (DoS) attacks via crafted MP4 files.

Recommended defensive actions

• Assess GPAC Project/MP4Box deployments for potential exposure to Denial of Service (DoS) attacks
• Review and update GPAC Project/MP4Box to version 2.5 or later
• Monitor for crafted MP4 files being supplied to GPAC Project/MP4Box
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the segmentation violation vulnerability in GPAC Project/MP4Box. Evidence is based on CVE Program records and NVD vulnerability details. The segmentation violation occurs in the GetESD function of GPAC Project/MP4Box before version 2.5. Defenders should verify exposure and review GPAC Project/MP4Box deployments for potential updates. The source confidence is high based on official CVE and NVD sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.