Cyber ·
CVE-2025-60491: use-after-free in GPAC/MP4Box triggered by crafted MPEG-2 TS input (CVSS 8.8)
Advisory on the oss-sec list about a heap use-after-free in dasher_flush_segment in GPAC/MP4Box, triggered by a specially crafted MPEG-2 TS input. CVSS 3.1 score 8.8 (HIGH), CWE-416. The advisory names a fixed commit.
Advisory published on October 23 on the oss-sec feed about CVE-2025-60491 in GPAC (MP4Box). A specially crafted MPEG-2 TS input can trigger a use-after-free on the heap in dasher_flush_segment. The classification is CWE-416 (Use After Free), with a CVSS 3.1 score of 8.8 (HIGH) and vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The advisory identifies the product as GPAC (MP4Box), affected version 2.5-DEV-rev1698-gfc2009fa7-master, at commit fc2009fa75631960743f8f7855dda8998167b5ab. The fix named is commit f6128214feb69cd689e4b9944a2621bc4ad8faf0. The text in the feed is a machine translation, so check the original description at the source.
Why it matters: teams that run MP4Box in media processing pipelines, especially with externally supplied files, should check whether any installation is at or before the affected commit and apply the fix. Rota Nacional does not detect or fix this vulnerability. To consult the original, open the 2026 oss-sec archive (Q4 period) and search for CVE-2025-60491.