CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11131

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file

A heap use-after-free vulnerability exists in GPAC's MP4Box component within the gf_filter_packet_destroy() function when processing crafted MPEG-2 Transport Stream files. The flaw, tracked as CVE-2025-60478 with a CVSS 3.1 score of 7.8 (high severity), has been patched in the project's repository.

Why it matters: Users and developers of GPAC/MP4Box face potential code execution or denial of service risk if they process untrusted MPEG-2 TS files; update to the fixed commit c592a144bbe339ee581ca88aaa3247362795b742 or later.

CVEsCVE-2025-60478
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary