Cyber ·
CVE-2025-60478: heap use-after-free in GPAC/MP4Box via crafted MPEG-2 TS file
Security advisory on a use-after-free flaw (CWE-416) in the MP4Box tool of the GPAC project, triggered by a crafted MPEG-2 TS file. CVSS 3.1 score of 7.8, rated high.
On 22 October, an open-source security mailing list published CVE-2025-60478. The advisory describes a heap use-after-free during packet destruction (gf_filter_packet_destroy) in MP4Box, the command-line tool of the GPAC project. A specially crafted MPEG-2 TS file can trigger the flaw. The CWE classification is CWE-416 and the CVSS 3.1 score is 7.8, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, assessed by BDU. According to the text, the affected version is 2.5-DEV-rev1617-g856674b22-master, and the fix is in commit c592a144bbe339ee581ca88aaa3247362795b742. The feed's machine translation indicates the original text is in English; consult the full original report at the source.
For readers, the relevance lies in any process that converts or analyzes media received from third parties with MP4Box. Rota Nacional does not patch third-party libraries or tools and does not solve this flaw. The concrete action is to check whether the installed version is affected, update to a revision that includes the fixed commit, and limit processing of untrusted files to isolated environments.