GPAC MP4Box Heap Use-After-Free in MPEG-2 TS Processing

Security researchers identified a memory corruption flaw in GPAC’s MP4Box tool that involves improper handling of crafted media files. The vulnerability, tracked as CVE-2025-60478, stems from issues within the software’s processing pipeline. According to the official advisory posted on the oss-security mailing list, the issue arises when MP4Box processes specific MPEG-2 Transport Stream inputs. This defect enables a heap use-after-free condition, which affects memory integrity if exploited successfully by a user with local access.

Root cause

The core issue lies within the `gf_filter_packet_destroy()` function in MP4Box. When the application processes a specially crafted MPEG-2 TS file, it fails to manage memory references correctly during the packet teardown phase. This mismanagement results in a use-after-free error, where the program attempts to access memory that has already been released back to the heap. Alexander A. Shvedov, who reported the flaw, detailed that this specific sequence of operations creates a window for memory corruption. The defect is classified under CWE-416, highlighting the inherent risks of dangling pointer dereferences in complex media parsing libraries.

Attack path

Exploiting this vulnerability requires an attacker to provide a malicious MPEG-2 TS file to a victim who runs it through MP4Box. The attack is not remote; it relies on local interaction, meaning the user must intentionally or inadvertently process the crafted file. Once the file is loaded, the application triggers the flawed packet destruction routine. This action corrupts the heap state. The CVSS 3.1 base score of 7.8 reflects the high impact on confidentiality, integrity, and availability, despite requiring user interaction and local access vectors.

Affected versions

The vulnerability impacts GPAC MP4Box builds leading up to the development revision 2.5-DEV-rev1617-g856674b22-master. Any version of the software that includes commit 856674b226d6cbe28a941ad223be38194cbf7d37 is considered vulnerable until patched. Users should verify their current build against this revision identifier to determine exposure. The advisory specifically calls out this development branch as affected.

Mitigation

• Update GPAC MP4Box to a version containing commit c592a144bbe339ee581ca88aaa3247362795b742.
• Avoid processing untrusted MPEG-2 TS files with MP4Box until the patch is applied.
• Restrict execution permissions for MP4Box to prevent unauthorized local file processing.
• Monitor system logs for unusual memory access errors or crashes during media conversion.

Signals worth monitoring

Teams should watch for unexpected crashes or segmentation faults in MP4Box processes, which often indicate memory corruption attempts. Check for anomalous heap allocation patterns in application logs, as use-after-free bugs frequently cause irregular memory behavior. Monitor for sudden spikes in CPU usage or process termination during file parsing tasks. If possible, enable detailed debug logging for media processing tools to capture stack traces. Isolate systems running vulnerable versions from untrusted file sources. Review access controls to ensure only authorized users can execute media conversion utilities.

What to do and how to stay safe: GPAC

• Verify your current GPAC MP4Box version and compare it against the vulnerable revision list.
• Apply the vendor-provided patch immediately if you are using an affected development build.
• Scan your environment for any untrusted MPEG-2 TS files that may have been processed recently.
• Restrict user permissions to limit the execution of media processing tools to trusted administrators only.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2025-60478?

It is a high-severity heap use-after-free vulnerability in GPAC MP4Box triggered by crafted MPEG-2 TS files.

Which versions of GPAC are affected?

Versions up to 2.5-DEV-rev1617-g856674b22-master are affected, specifically those including commit 856674b22.

Is there a fix available?

Yes, the vulnerability is fixed in commit c592a144bbe339ee581ca88aaa3247362795b742.