Cyber ·
CVE-2025-60492: uncontrolled recursion in the GPAC/MP4Box BIFS decoder
Security advisory on uncontrolled recursion (CWE-674) in the GPAC/MP4Box BIFS decoder. A specially crafted MP4 input can exhaust the process stack during decoding. The reported severity is medium, with CVSS 3.1 of 5.5, and the fixed build is named in the original advisory.
The advisory describes CVE-2025-60492, in which a specially crafted MP4 input causes uncontrolled recursion in the BIFS decoder of GPAC, including the MP4Box tool. According to the text, the recursion can exhaust the process stack during decoding. The weakness classification is CWE-674, uncontrolled recursion. The affected product is GPAC (MP4Box), development version 2.5-DEV-rev1687 on the master branch, identified by commit e44a4e2b0d193566619ada71599e70255699da94. The fix appears in commit 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4. The CVSS 3.1 score is 5.5, rated medium, with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, based on an assessment attributed to CISA. The vector indicates local access, no privileges required, user interaction, and impact limited to availability. The report was posted to the oss-sec list on October 23, and the responsible researcher is credited in the original advisory. To verify, consult the oss-sec list and the official GPAC repository, confirm the fixed commit, and compare it with the version you run.