CVE-2025-60478 in MP4Box
Summary
by MITRE • 10/21/2026
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as CVE-2021-3786 represents a critical memory management flaw within the GPAC Project, specifically affecting the MP4Box utility prior to version 2.5. This issue is classified under Common Weakness Enumeration (CWE) category CWE-416, which denotes Use After Free errors. Such vulnerabilities arise when software continues to use pointers that reference deallocated or freed memory regions, leading to unpredictable behavior and potential system compromise. In this specific instance, the flaw resides in the gf_filter_packet_destroy function located within the filter_core/filter_pck.c source file of the GPAC framework. The vulnerability is triggered specifically through the processing of malformed MPEG-2 media files, highlighting a failure in input validation and memory lifecycle management during packet destruction routines.
From a technical perspective, the root cause involves improper handling of object lifecycles when parsing complex or crafted multimedia streams. When MP4Box processes an MPEG-2 file containing specific maliciously constructed elements, it may free certain data structures associated with filter packets prematurely. However, subsequent operations within the same processing pipeline attempt to access these already freed memory locations. This dereferencing of invalid pointers results in a use-after-free condition. Depending on how the operating system manages heap memory and whether additional exploitation techniques are applied, this can lead to immediate application crashes or more severe consequences such as arbitrary code execution if an attacker can control the content written into the reused memory space. The primary observed impact is a Denial of Service (DoS), where the application terminates unexpectedly due to segmentation faults or access violations caused by accessing invalid memory addresses.
The operational impact of this vulnerability extends beyond simple application instability for users and organizations relying on GPAC tools for media conversion, analysis, or streaming preparation. Since MP4Box is often used in automated pipelines for video processing, a crash induced by a crafted file can disrupt continuous workflows, leading to data loss if unsaved work is involved or significant downtime in services that depend on real-time or batch transcoding operations. Furthermore, while the primary reported impact is DoS, use-after-free vulnerabilities are historically among the most dangerous classes of memory corruption bugs because they provide attackers with a mechanism to manipulate program flow and potentially achieve remote code execution. This makes the vulnerability particularly concerning for any deployment where MP4Box processes untrusted or user-uploaded media files without sufficient sandboxing or isolation mechanisms.
To mitigate this risk, organizations must ensure that all instances of GPAC Project tools are upgraded to version 2.5 or later, where the underlying memory management logic in gf_filter_packet_destroy has been corrected to prevent premature deallocation and subsequent access. In environments where immediate patching is not feasible, defensive measures should include implementing strict input validation filters at network ingress points to block malformed MPEG-2 files before they reach the MP4Box application. Additionally, deploying runtime protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) can help mitigate the exploitability of memory corruption vulnerabilities by making it significantly harder for attackers to predict memory layouts or execute injected code. Security teams should also monitor logs for unexpected termination events in processes utilizing GPAC tools, which may indicate attempted exploitation activities aligned with ATT&CK technique T1499, Endpoint Denial of Service.