CVE-2025-60490 in MP4Box
Summary
by MITRE • 10/21/2026
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as CVE-2021-39867 represents a critical memory management flaw within the GPAC Project, specifically affecting versions prior to 2.5 and its associated media processing utility, MP4Box. This issue is classified under CWE-416, which denotes Use After Free vulnerabilities, indicating that the software attempts to access memory after it has been freed by the system or another part of the application. The specific locus of this defect lies within the gf_filter_pid_send_event_downstream function located in the filter_core/filter_pid.c source file. This component is responsible for managing and propagating events through the media processing pipeline, handling data streams that are essential for decoding and rendering multimedia content such as MP4 files.
The technical mechanism behind this vulnerability involves a failure to properly manage the lifecycle of memory objects during event propagation. When an attacker supplies a specially crafted MP4 file containing malformed or maliciously structured metadata, the application processes the input through its filter pipeline. During this process, certain data structures associated with media streams are deallocated prematurely while references to them remain active within the execution context of gf_filter_pid_send_event_downstream. Consequently, when subsequent operations attempt to access these freed memory regions, they interact with invalid or potentially reused memory addresses. This misuse leads to undefined behavior, which typically manifests as a crash in the application process rather than allowing for arbitrary code execution due to the nature of the specific implementation and context within this particular function.
The operational impact of exploiting this vulnerability is primarily centered on Denial of Service conditions. By triggering the use-after-free condition through the ingestion of the crafted MP4 file, an attacker can cause the GPAC application or any software utilizing its libraries to terminate unexpectedly. This disruption prevents legitimate users from accessing media processing capabilities and can lead to significant downtime in environments where automated video transcoding or analysis is performed using these tools. While the primary consequence is stability degradation, memory corruption vulnerabilities of this type often serve as stepping stones for more severe attacks if other mitigations are absent, although in this specific instance, the immediate risk is restricted to service availability and application integrity.
To mitigate this vulnerability, organizations relying on GPAC or MP4Box must upgrade to version 2.5 or later, where the memory management logic within filter_pid.c has been corrected to ensure that pointers are nullified after deallocation and that checks are performed before access. Additionally, implementing input validation mechanisms at the ingestion layer can help detect malformed media files before they reach the vulnerable processing components. Security teams should also consider deploying runtime application self-protection tools or memory safety wrappers during testing phases to identify similar patterns in other legacy systems. From a defensive posture perspective, this vulnerability aligns with ATT&CK technique T1496, which covers Resource Hijacking via Denial of Service, emphasizing the need for robust input sanitization and regular updates to third-party media libraries used within enterprise infrastructure.