Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2025-60475

CVE-2025-60475: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2025-60475 is a buffer overflow flaw in GPAC MP4Box that enables attackers to trigger denial of service through malicious input. This article covers technical details, affected versions, and mitigation strategies.

Published:

CVE-2025-60475 Overview

CVE-2025-60475 is a buffer overflow vulnerability in the gf_ac4_parser_bs function located in /media_tools/av_parsers.c of the GPAC Project's MP4Box multimedia framework. Attackers can trigger the flaw by supplying a crafted input file to the parser, causing a Denial of Service (DoS) condition. The vulnerability affects GPAC releases prior to version 2.5. Exploitation requires the target to process attacker-controlled media data through the AC4 audio parser. The issue was fixed upstream in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.

Critical Impact

Processing a malicious media file through MP4Box crashes the application, disrupting automated media pipelines and transcoding workflows that depend on GPAC.

Affected Products

  • GPAC Project MP4Box versions prior to 2.5
  • gf_ac4_parser_bs function in /media_tools/av_parsers.c
  • Downstream applications and services that bundle GPAC libraries for AC4 audio parsing

Discovery Timeline

  • 2026-10-20 - CVE-2025-60475 published to the National Vulnerability Database
  • 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2025-60475

Vulnerability Analysis

The vulnerability resides in gf_ac4_parser_bs, a bitstream parsing routine responsible for interpreting AC4 audio frames inside media containers handled by MP4Box. The function reads length and index values from attacker-controlled data without sufficient bounds validation. When these values exceed the capacity of the destination buffer, the parser writes outside the allocated region. The resulting memory corruption terminates the process and halts media handling tasks.

GPAC is widely integrated into transcoding pipelines, streaming servers, forensic tooling, and desktop media utilities. A crash in MP4Box interrupts batch jobs and can be triggered repeatedly against services that automatically ingest user-submitted content. The EPSS score currently places exploitation probability in the low range, consistent with a DoS-only outcome.

Root Cause

The root cause is missing boundary enforcement on fields parsed from the AC4 bitstream inside gf_ac4_parser_bs. The function trusts size descriptors supplied by the input before using them to drive buffer operations. This pattern aligns with classic buffer overflow weaknesses in media parsers that process untrusted container formats.

Attack Vector

An attacker crafts a malformed media file containing manipulated AC4 bitstream structures. The attacker delivers the file to a victim who processes it with MP4Box, or submits it to a backend service that calls GPAC libraries during ingestion. Parsing the crafted input triggers the overflow and terminates the process, producing a denial of service. See the GPAC Issue Tracker and the PoC Documentation for reproduction details.

No verified exploit code is published beyond the public proof-of-concept materials referenced above. The vulnerability mechanism is described in prose because no sanitized exploitation code is available for inclusion.

Detection Methods for CVE-2025-60475

Indicators of Compromise

  • Unexpected crashes or abnormal termination of MP4Box processes during media ingestion
  • Core dumps or segmentation fault entries referencing gf_ac4_parser_bs or av_parsers.c
  • Media files containing malformed AC4 audio tracks submitted by untrusted sources

Detection Strategies

  • Monitor process exit codes from GPAC binaries in automated pipelines and alert on repeated non-zero terminations
  • Inspect inbound media files for AC4 audio streams and validate structural integrity before passing to GPAC
  • Correlate crash telemetry with the source of the input file to identify malicious submitters

Monitoring Recommendations

  • Enable application crash reporting on hosts running GPAC and forward events to a centralized logging platform
  • Track GPAC version inventories across build and production systems to identify unpatched instances
  • Alert on recurring parser faults originating from the same upload channel or tenant

How to Mitigate CVE-2025-60475

Immediate Actions Required

  • Upgrade GPAC and MP4Box to version 2.5 or later across all systems that process untrusted media
  • Audit services, build images, and container registries for bundled GPAC libraries predating the fix
  • Restrict MP4Box execution to sandboxed workers with resource limits to contain crashes

Patch Information

The fix is included in the upstream commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b and released in GPAC 2.5. Rebuild any downstream packages or container images against the patched source tree. Verify installed versions after deployment using MP4Box -version.

Workarounds

  • Reject or quarantine media files containing AC4 audio tracks from untrusted sources until patches are applied
  • Run MP4Box under a process supervisor that restarts failed jobs and isolates faults from the host
  • Apply strict file size and format validation at the ingestion boundary before invoking GPAC
bash
# Verify the installed GPAC version
MP4Box -version

# Upgrade from source to the patched release
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout v2.5
./configure && make && sudo make install

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne