CVE-2025-60476 in MP4Box
Summary
by MITRE • 10/21/2026
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in the GPAC Project's MP4Box utility, specifically within versions prior to 2.5, represents a critical memory management flaw located in the gf_odf_ac4_cfg_clean_list function found in the odf/descriptors.c source file. This issue is classified as a heap use-after-free condition, which occurs when software continues to access or reference a block of memory after it has been freed and potentially reallocated for other purposes. In this specific context, the flaw arises during the processing of Advanced Audio Coding (AC4) configuration data within MP4 container files. When an attacker supplies a specially crafted AC4 file containing malformed or maliciously structured descriptors, the application fails to properly manage the lifecycle of memory objects associated with these descriptors. The code path attempts to clean up or release resources related to the AC4 configuration but does so incorrectly, leaving pointers that still reference the now-deallocated heap memory regions.
From a technical perspective, this use-after-free vulnerability allows for significant operational impact on system stability and security. If an attacker can control the content of the freed memory through subsequent allocations before the dangling pointer is accessed again, they may achieve arbitrary code execution with the privileges of the process running MP4Box. However, in many practical scenarios involving media parsing tools like MP4Box, which are often used for file conversion or analysis rather than interactive playback by end-users, the immediate and most common consequence is a Denial of Service (DoS). The application will likely crash due to an invalid memory access exception when it attempts to read from or write to the freed heap region. This crashes can disrupt workflows that rely on automated processing of media files, leading to downtime in content pipelines where MP4Box is used for batch processing or validation tasks.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-416, which defines use-after-free errors as a distinct class of memory corruption vulnerabilities. The exploitation vector involves the supply of maliciously crafted input data, specifically an AC4 file embedded within an MP4 container, to trigger the erroneous code path in the descriptor cleaning routine. In terms of threat modeling and attack patterns, this behavior is consistent with techniques described in the MITRE ATT&CK framework under memory corruption exploits. Attackers may leverage such vulnerabilities for initial access or privilege escalation if the vulnerable binary is executed by a privileged user, although the primary documented impact remains service disruption through application crashes.
To mitigate this risk, organizations and developers relying on GPAC Project tools must ensure that MP4Box is updated to version 2.5 or later, where the memory management logic in gf_odf_ac4_cfg_clean_list has been corrected to prevent access to freed resources. For environments where immediate patching is not feasible, input validation strategies should be implemented at the ingestion layer of any media processing pipeline. This includes sanitizing incoming AC4 and MP4 files to ensure they conform strictly to specification standards before being passed to vulnerable binaries. Additionally, enabling memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can help mitigate the exploitability of this vulnerability by making it more difficult for attackers to predict memory layouts or execute injected code, thereby reducing the likelihood of successful exploitation even if a crash occurs.