Zero Radar
← feed
HighVulnerabilityCVE-2025-60467updated 27 Oct 2026, 01:21 UTC

GPAC MP4Box can crash when given a specially crafted media file

A specially built video file can make the MP4Box media tool crash. The crash can stop the tool from working but is not described as giving an attacker control of the machine.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?YesVersion 26.02.0 or later, or the upstream fix commit 976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker crafts fileMalformed MPEG-2 TS media file
  2. 2File is processedMP4Box reads the file
  3. 3Memory misusedFreed task is still accessed
  4. 4Tool crashesProcessing stops abruptly
  5. ResultMP4Box crashes, denial of service

What happened

A use-after-free flaw in the gf_filter_pid_inst_swap_delete_task function in GPAC/MP4Box filter core (filter_core/filter_pid.c) lets a crafted media file trigger memory misuse, causing a denial of service.

Why it is dangerous: Anyone who processes untrusted media files with MP4Box can have the tool crash or stop working, disrupting media pipelines and services that rely on it.

Are you affected?

You are affected if you run GPAC/MP4Box versions before 26.02.0 and process media files from untrusted sources.

GPAC (MP4Box) before 26.02.0

What to do

  1. Update GPAC/MP4Box to version 26.02.0 or later
  2. Until updated, avoid processing media files from untrusted sources with MP4Box
  3. Check that your GPAC build includes commit 976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77 if you build from source

Timeline

  1. 24 Jun 2026, 23:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 21:28 UTC
    Reported by oss-security · oss-security
  3. 26 Oct 2026, 21:31 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 01:21 UTC
    NVD reported on it · NVD
  5. 27 Oct 2026, 01:21 UTC
    Severity raised to high

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2025-60467
CVSS
7.5 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
24 Jun 2026, 23:16 UTC
On Zero Radar
26 Oct 2026, 21:31 UTC (124 days after disclosure)
Last change
27 Oct 2026, 01:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GPAC MP4Box can crash when given a specially crafted media file · Zero Radar