CVE-2025-60487 in MP4Box
Summary
by MITRE • 10/21/2026
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the GPAC Project, specifically affecting versions prior to 2.5 in the MP4Box utility, represents a critical memory safety failure rooted in improper input validation and bounds checking. The core technical flaw resides within the gf_isom_get_esd function located in the isomedia/isom_read.c source file. This function is responsible for parsing Elementary Stream Descriptors (ESD) which are integral components of ISO Base Media File Format structures, commonly found in MP4 containers. While the initial vector involves a crafted XML file, it indicates that the underlying parser or an intermediate processing step fails to adequately sanitize or validate data before passing it into memory management routines associated with ESD handling. This lack of rigorous boundary checks allows for a segmentation violation, technically known as a buffer overflow or out-of-bounds read/write, which occurs when the application attempts to access memory addresses that are not allocated to its process space.
From an operational perspective, this vulnerability primarily facilitates Denial of Service attacks against systems relying on MP4Box for media processing tasks such as transcoding, muxing, or stream analysis. An attacker can exploit this flaw by supplying a specially crafted XML file designed to trigger the erroneous memory access pattern within gf_isom_get_esd. Upon execution, the segmentation violation causes the application to crash abruptly, resulting in immediate service disruption. In environments where MP4Box is used as part of an automated pipeline or a web-facing media processing service, this can lead to significant downtime and resource exhaustion if the process is not properly monitored and restarted by external watchdogs. The impact extends beyond simple availability loss; depending on the specific memory state at the time of the crash, there may be potential implications for data integrity within temporary files created during the parsing operation.
This vulnerability aligns with CWE-125, Out-of-bounds Read, or potentially CWE-787, Out-of-bounds Write, depending on whether the crafted input causes a read from invalid memory or attempts to write beyond allocated buffers. The exploitation technique falls under ATT&CK tactic T1499, Endpoint Denial of Service, specifically utilizing resource exhaustion through application crashes. It also reflects weaknesses in CWE-20, Improper Input Validation, as the software fails to verify that user-supplied XML data conforms to expected structural and length constraints before processing it within critical media parsing functions. The presence of this flaw highlights a broader issue in legacy multimedia frameworks where performance optimizations sometimes bypass strict safety checks, leaving complex parsers vulnerable to malformed input attacks.
Mitigation strategies for this vulnerability focus primarily on immediate software updates and defensive configuration practices. Organizations utilizing GPAC Project tools must upgrade to version 2.5 or later, where the gf_isom_get_esd function has been patched with appropriate bounds checking and validation logic to prevent segmentation violations caused by maliciously crafted inputs. In scenarios where upgrading is not immediately feasible, input sanitization at the network perimeter using Web Application Firewalls or custom script filters can help block XML files containing suspicious patterns associated with this exploit vector. Additionally, deploying media processing workloads within sandboxed environments or containers limits the blast radius of a potential crash, ensuring that system stability and other services remain unaffected by localized application failures. Regular auditing of third-party multimedia libraries for known memory safety issues is also recommended to maintain robust security postures in digital asset management systems.