CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11189

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input

CVE-2025-60492 is an uncontrolled recursion flaw in GPAC MP4Box affecting version 2.5-DEV that allows a crafted MP4 file to exhaust the decoder's process stack. The vulnerability has a CVSS 3.1 score of 5.5 (Medium) and requires local access and user interaction to trigger. A fix has been applied in commit 8e7b9a3a.

Why it matters: Users and systems processing untrusted MP4 files with MP4Box are at risk of denial of service; validate input files and apply the patched commit to prevent stack exhaustion attacks.

CVEsCVE-2025-60492
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary