Cyber ·
CVE-2025-60467: use-after-free in GPAC/MP4Box when processing a malicious MPEG-2 TS file
Advisory from the oss-sec feed, published on 26 October 2026, describing a use-after-free vulnerability in GPAC/MP4Box triggered by a crafted MPEG-2 TS file. Classified as CWE-416, with CVSS 3.1 score 4.3 (medium).
On 26 October, the oss-sec feed published an advisory on CVE-2025-60467, a use-after-free vulnerability (CWE-416) in GPAC, whose command-line tool is MP4Box. According to the text, the flaw can be triggered by processing an MPEG-2 TS file built for that purpose. The source points to the function gf_filter_pid_inst_swap_delete_task() in the GPAC filter session core, at filter_core/filter_pid.c, line 574, described as a scheduled task that deletes an object that may still be used.
The affected product is gpac/gpac, in versions before the fix commit, whose identifier appears in the references of the original advisory. The reported CVSS 3.1 score is 4.3 (medium), with a network attack vector, low complexity, no privileges required, user interaction required, no confidentiality impact, no integrity impact and low availability impact. The credited researcher is identified in the original advisory. The archived text is truncated in the technical description, so the full analysis depends on the original document.
Rota Nacional does not patch third-party libraries and does not replace applying the fix commit. To assess impact in your organization, check the affected versions and references in the original, identify where GPAC or MP4Box is used, including in transcoding pipelines, and apply the update indicated by the project. Meanwhile, treat video files from external sources as untrusted.