CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream

As cited

Copy frozen at 2026-10-28 06:07 UTC (site build).

vulnerabilities

CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream

CVE-2025-60475 is a global buffer overflow read vulnerability in GPAC's AC-4 parser (gf_ac4_parser_bs function) that allows out-of-bounds memory access when processing a crafted AC-4 stream. The flaw stems from improper validation of a frame_rate_index value read from user-controlled input, enabling read access beyond allocated buffer boundaries.

Why it matters: Organizations using GPAC or MP4Box to process audio or video streams should assess whether this code path is reachable in their deployment; attackers can trigger a crash or information disclosure by sending a malformed AC-4 stream.

Source published

2026-10-28 02:12 UTC

First seen by Cybersecurity Tracker

2026-10-28 05:15 UTC