CVE-2025-60482: use-after-free in the GPAC/MP4Box heap during AC-4 descriptor cleanup

What happened and what to do

The advisory, published on 29 October on the oss-sec list, records a use-after-free in the GPAC (MP4Box) heap, tracked as CVE-2025-60482 and classified as CWE-416. The confirmed affected version is 2.5-DEV-rev1593-gfe88c3545-master, corresponding to commit fe88c3545aadd597b250ccf23271d5d3de50ccc8. The upstream fix is commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b. The CVSS 3.1 score is 5.5, vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, with availability impact and required user interaction.

In practice, a company that processes MP4 and AC-4 files from external sources, such as transcoding pipelines, media indexing or content ingestion, should first locate where MP4Box is used, including container images and internal tools, and compare the revision in use with the fixed commit. Binaries without the fix should be rebuilt or updated from a version containing commit e02d1fd. Because the vector points to availability impact, parsing of untrusted files is best run in isolated processes with resource limits and automatic restart, and crashes of those processes should be monitored as a signal of exploitation or malicious input.

How the consultancy can help

We can diagnose where GPAC/MP4Box is used across your systems, including builds, container images and media pipelines, and compare each version with the fixed commit. We then design and implement the update or rebuild, the isolation of external file parsing and crash monitoring, on your infrastructure.

Next step

If your company uses GPAC or MP4Box in media processing, send a short description of your workflow, the sources of your files and the runtime environment. We will then prepare a scoped proposal for diagnosis and implementation.