Does GPAC MP4Box AC-4 Parsing Flaw Expose Your Media Workflows?
A heap buffer overflow in GPAC MP4Box allows remote attackers to crash services via crafted AC-4 files, rated medium severity by BDU assessment.
Key points
- CVE-2025-60480 affects GPAC MP4Box version 2.5-DEV-rev1593-gfe88c3545-master
- The flaw stems from out-of-bounds heap reads during AC-4 configuration parsing
- A patch has been committed to fix the heap-based buffer overflow issue
The short version
- GPAC MP4Box contains a heap buffer overflow vulnerability in its AC-4 parser
- The flaw is rated CVSS 6.5 (Medium) and requires user interaction to exploit
- Alexander A. Shvedov reported the issue to the oss-security mailing list
The details
A heap buffer overflow exists in GPAC MP4Box, specifically within the `gf_odf_ac4_cfg_alternative_info` function. According to the official advisory on the oss-security mailing list, this flaw arises when the application parses a crafted AC-4 file. The vulnerability was identified in version 2.5-DEV-rev1593-gfe88c3545-master. Alexander A. Shvedov, also known as @sigdevel, reported the finding. The issue allows an out-of-bounds heap read, which is classified under CWE-122. This type of memory corruption can lead to application crashes or potentially more severe outcomes if exploitable.
The context
The Common Vulnerability Scoring System version 3.1 rates this flaw at 6.5, categorising it as Medium severity. The BDU assessment notes that while the attack vector is network-based and requires low complexity, it does demand user interaction. The impact is limited to high availability loss, with no compromise of confidentiality or integrity. The vulnerability was publicly disclosed on 20 October. Developers have since addressed the issue in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
Next steps
Organisations using the affected development build of GPAC MP4Box should verify their versions immediately. Teams processing untrusted AC-4 media files are at higher risk of encountering this flaw. Updating to the patched version is the primary mitigation strategy. Until updates are applied, restricting the input of unverified AC-4 files can reduce exposure. Monitoring for unexpected application terminations in media processing services is also advisable.
What defenders should look for
Security operations teams should monitor for unexpected application crashes or segmentation faults in media processing services. Look for anomalous heap memory access patterns in system logs. Check for sudden spikes in resource usage or failed processes associated with MP4Box. Investigate any files that trigger immediate service termination. Validate that all media parsers are running the latest patched versions. Ensure that sandboxing is enabled for services handling untrusted media formats to limit the blast radius of potential exploits.
What to do and how to stay safe: GPAC
- Verify if your environment runs the affected GPAC MP4Box development version
- Update to the latest patched release once the vendor provides an update
- Restrict processing of AC-4 files from untrusted sources until patched
- Monitor application logs for out-of-bounds read errors or crashes
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2025-60480?
The CVSS 3.1 score is 6.5, which is rated as Medium severity.
Who reported this vulnerability?
Alexander A. Shvedov (@sigdevel) reported the flaw to the oss-security list.
Is there a fix available for this issue?
Yes, a fix has been committed in e02d1fd24cdc26acb1b236ab38b3832cffcae21b.
