Cyber ·
CVE-2025-60476: use-after-free in heap in MP4Box (GPAC) with CVSS 8.8
Security advisory on a heap use-after-free in MP4Box (GPAC) during AC-4 descriptor cleanup, with CVSS 3.1 score of 8.8 and a fix identified in the project.
CVE-2025-60476 is classified as CWE-416 (use after free) and affects MP4Box, part of the GPAC project, in the function gf_odf_ac4_cfg_clean_list(), during cleanup of AC-4 descriptors. The CVSS 3.1 score is 8.8 (high), with network vector, no privileges required and user interaction; the impact is described as high for confidentiality, integrity and availability. The affected version reported is 2.5-DEV-rev1593-gfe88c3545-master, and the fix appears in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. The advisory was published on the oss-sec feed on October 22, 2026, and the evaluation mentioned is the BDU assessment.
The source is an automatic translation of the oss-sec feed and the description is truncated. To verify, consult the original advisory on the oss-sec list, compare the affected commit with the GPAC project history, and confirm the MP4Box version installed. This piece contains no exploit code.