CVE-2025-60480 in MP4Box
Summary
by MITRE • 10/19/2026
A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the GPAC Project's MP4Box utility, specifically within version 2.5-DEV-rev1593-gfe88c3545-master, represents a critical memory safety issue located in the gf_odf_ac4_cfg_alternative_info function found in the odf/descriptors.c source file. This component is responsible for parsing and processing metadata descriptors associated with Advanced Audio Coding (AC-4) streams within MP4 container files. The core technical flaw constitutes a heap buffer overflow, which occurs when the application writes data to a memory location beyond the bounds of an allocated heap region. In this specific context, the vulnerability arises during the handling of crafted AC4 configuration information where input validation mechanisms fail to adequately verify the length or structure of incoming descriptor fields before copying them into fixed-size buffers. This lack of rigorous boundary checking allows an attacker who supplies a maliciously constructed AC4 file to trigger out-of-bounds writes on the heap, corrupting adjacent memory structures and leading to unstable application state.
From a technical perspective, this flaw aligns with Common Weakness Enumeration (CWE) category CWE-122, which describes Heap-based Buffer Overflow. The exploitation of such vulnerabilities typically relies on manipulating the heap metadata or overwriting critical data structures located immediately after the target buffer. In media processing software like MP4Box, these buffers often hold pointers to other objects or configuration parameters. When an attacker crafts a file with oversized descriptor fields, the overflow can overwrite function return addresses, virtual table pointers, or integer variables that control memory allocation sizes. This corruption disrupts the normal execution flow of the program, causing it to crash immediately upon processing the malformed input. The primary operational impact is a Denial of Service (DoS), as the application terminates unexpectedly when encountering this corrupted state. For users relying on MP4Box for media conversion or analysis workflows, such crashes can lead to data loss if unsaved work is involved and disrupt automated pipelines that depend on stable processing of audio-video containers.
The attack vector requires an attacker to supply a specially crafted AC4 file to the victim who then processes it using the vulnerable version of MP4Box. This could occur in scenarios where media files are uploaded for transcoding, analyzed by security tools, or played back through applications that utilize GPAC libraries. The vulnerability is classified under MITRE ATT&CK technique T1203, which covers Exploitation for Denial of Service. While heap overflows can sometimes lead to remote code execution if the attacker successfully controls memory layout and overwrite targets with shellcode pointers, in this specific instance, the immediate consequence observed is a crash resulting in service disruption. The severity is heightened by the fact that MP4Box is often used as a command-line tool in automated environments where unexpected termination halts processing jobs without graceful error handling or recovery mechanisms.
Mitigation strategies for this vulnerability primarily involve updating to patched versions of GPAC and MP4Box where the gf_odf_ac4_cfg_alternative_info function has been hardened with proper input validation checks. Developers should ensure that all descriptor lengths are verified against buffer capacities before any memory copy operations occur, adhering strictly to CWE-130 guidelines on improper handling of length parameters. For end-users unable to immediately update their software environments, it is advisable to avoid processing untrusted or unknown source AC4 files using MP4Box until a patch is available. Additionally, employing sandboxed execution environments for media parsing tasks can limit the impact of potential exploits by isolating the process from critical system resources and preventing privilege escalation if further exploitation vectors are discovered in related components. Regular auditing of third-party library integrations and keeping dependencies up to date remains essential for maintaining robust security posture against memory corruption vulnerabilities.