CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11818

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

A heap use-after-free vulnerability (CVE-2025-60482) was identified in GPAC MP4Box, a multimedia processing tool, within the AC-4 descriptor cleanup routine. The flaw affects version 2.5-DEV and has been patched in upstream commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b, rated CVSS 5.5 (Medium) with availability impact.

Why it matters: Organizations and developers using GPAC MP4Box to process or transcode multimedia files should update to the fixed version to prevent denial of service attacks triggered by malformed AC-4 audio descriptors.

CVEsCVE-2025-60482
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary