CVE-2025-60468 GPAC CVE debrief

Who should care

System administrators and users who use GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master should verify and apply patches to prevent a denial of service. System administrators should review and apply patches to prevent exploitation. Users of the affected product should be aware of the vulnerability and take steps to mitigate it. Security teams should prioritize patching and monitor for suspicious activity. Vulnerability management teams should verify 3

Why it matters

The vulnerability can cause a denial of service (local) and requires verification and application of patches to prevent exploitation.

• Denial of service (local) can occur when processing specially crafted files
• Verification of patches is required to prevent exploitation
• Local authenticated users can trigger the bug

Technical summary

The vulnerability is caused by improper access to freed objects during PID instance swap/delete cleanup in the filter_core/filter_pid.c file, leading to a heap use-after-free. A local, authenticated user can trigger the bug by processing a specially crafted MPEG-2 TS/MP4 file with MP4Box, causing a denial of service (local). The impact is: cause a denial of service (local). The component is: filter_core/filter_pid.c (L:574-580): function gf_filter_pid_inst_swap_delete_task() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free.

Defensive priority

Medium priority should be given to verifying and applying patches, as the vulnerability can cause a denial of service.

Recommended defensive actions

• Verify and apply patches from the vendor
• Restrict access to the vulnerable component
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD. The CVE Program record and NVD vulnerability detail page provide official information about the vulnerability. A local, authenticated user can trigger the bug by processing a specially crafted MPEG-2 TS/MP4 file with MP4Box, causing a denial of service (local). The vulnerability is caused by improper access to freed objects during PID instance swap/delete cleanup in the filter_core/filter_pid.c file, leading to a heap use-after-free. The impact is: cause a denial of service (l

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.