CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11132

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup

CVE-2025-60476 is a heap use-after-free vulnerability in GPAC MP4Box affecting version 2.5-DEV-rev1593-gfe88c3545-master in the AC-4 descriptor cleanup function. The vulnerability has a CVSS 3.1 score of 8.8 and allows remote code execution without user privileges required beyond interaction. A fix is available in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.

Why it matters: Organizations using GPAC MP4Box for media processing must patch this vulnerability immediately to prevent remote code execution from malicious MP4 files, particularly in automated transcoding or streaming workflows.

CVEsCVE-2025-60476
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary