Cyber ·
CVE-2025-60482: use-after-free in GPAC/MP4Box during AC-4 descriptor cleanup
Use-after-free flaw (CWE-416) in GPAC/MP4Box, confirmed in revision 2.5-DEV-rev1593 and fixed by an upstream commit. CVSS 3.1 score of 5.5, rated medium. Advisory posted to the oss-sec feed on 29 October.
An advisory posted to the oss-sec feed on 29 October describes a use-after-free flaw in the heap of GPAC, the toolkit that includes MP4Box. The vulnerability is recorded as CVE-2025-60482 and classified as CWE-416, Use After Free. The text identifies the affected revision 2.5-DEV-rev1593-gfe88c3545-master as confirmed, with commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 as the reference point. The upstream fix named is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
The CVSS 3.1 score is 5.5, medium severity, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. Under this vector the main impact is availability: exploitation requires local access and user interaction, and no confidentiality or integrity impact is declared. The CISA ADP assessment appears in the CVE record.
For your organization, the relevance is checking whether any GPAC or MP4Box installation, including on workstations or media processing pipelines, predates the fix. The advisory gives no information on active exploitation.
To check the original, consult the CVE record and the oss-sec feed post, which are the primary sources. Confirm the commit hashes in the project's official repository before any operational decision.