CVE-2025-60482 GPAC CVE debrief

Who should care

Defenders responsible for media processing systems, particularly those using GPAC Project/MP4Box, should assess exposure and verify the integrity of AC4 files. This includes operators, platform administrators, vulnerability management teams, and security teams. They should prioritize verifying AC4 file integrity and assessing exposure in media processing systems.

Why it matters

Defenders should prioritize verifying AC4 file integrity and assessing exposure in media processing systems using GPAC Project/MP4Box due to a potential Denial of Service (DoS) vulnerability.

• Potential Denial of Service (DoS) in media processing systems
• Need to verify integrity of AC4 files
• Possible exposure in systems using GPAC Project/MP4Box

Technical summary

The gf_odf_ac4_cfg_clean_list function in the descriptors.c file of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is vulnerable to a heap use-after-free attack. This can be exploited by supplying a crafted AC4 file, potentially causing a Denial of Service (DoS). The vulnerability affects media processing systems using GPAC Project/MP4Box, particularly those responsible for handling AC4 files. Defenders should prioritize verifying AC4 file integrity and assessing exposure in these systems. The vulnerability has a potential impact on the availability of these systems.

Defensive priority

Defenders should prioritize verifying the integrity of AC4 files and assessing exposure in media processing systems.

Recommended defensive actions

• Verify the integrity of AC4 files processed by GPAC Project/MP4Box
• Assess exposure in media processing systems
• Monitor for crafted AC4 files
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide limited information about the vulnerability, with no additional details on affected versions or remediation. Defenders should verify AC4 file integrity and assess exposure in media processing systems using GPAC Project/MP4Box. The vulnerability has a potential Denial of Service (DoS) impact, and defenders should prioritize verifying AC4 file integrity and assessing exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.