Cyber ·
CVE-2025-60490: use-after-free in GPAC/MP4Box via crafted MPEG-2 TS input
October 23 alert on a heap use-after-free in GPAC/MP4Box, triggered by a specially crafted MPEG-2 TS input. CVSS 3.1 score of 8.8, rated high, with a fix identified in the code.
According to the advisory posted on the oss-sec list, CVE-2025-60490 is classified as CWE-416, use after free, and occurs in the function gf_filter_pid_send_event_downstream of MP4Box, a tool from the GPAC project. The problem can be triggered by a specially crafted MPEG-2 TS input. The affected version given is 2.5-DEV-rev1665-g3f20eb0cd-master, identified by commit 3f20eb0cd22116367c036e6ffe6ace299b38d686. The indicated fix is in commit d0793f92e04fe284a25c2a9335cc5edc68deb6d4.
The CVSS 3.1 score is 8.8, rated high, with network vector, low complexity, no privileges required and user interaction. The declared impact is high for confidentiality, integrity and availability. The description in the text received is truncated, so no further details on the exact mechanism or on exploitation are given here.
To consult and verify, read the original advisory on the 2026 oss-sec list and confirm in the GPAC project repository whether the fix commit is included in the version you use. The severity assessment cited is from BDU, as stated in the source, and can be compared with other vulnerability databases.