CVE-2025-60492 in MP4Box
Summary
by MITRE • 10/21/2026
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the GPAC Project, specifically affecting versions prior to 2.5, resides in the gf_bifs_dec_node function located in the field_decode.c source file. This component is responsible for decoding Binary Format for Scenes (BIFS) data embedded within MP4 containers. BIFS is a scene description language defined by MPEG-4 standards that allows for the specification of interactive multimedia content, including 3D graphics and user interface elements. When an attacker supplies a specially crafted MP4 file containing malformed or excessively large BIFS node structures, it triggers a stack overflow condition during the decoding process. The root cause lies in insufficient validation of input data sizes relative to the allocated stack space within the recursive parsing logic of the decoder.
From a technical perspective, this flaw represents an improper limit on array indexing or buffer size verification that leads to memory corruption. When the parser encounters specific malformed sequences in the BIFS stream, it fails to correctly bound its recursion depth or variable allocation, causing the program counter and local variables to overwrite adjacent stack memory. This overwriting disrupts the normal flow of execution, typically resulting in a crash of the application process. In some scenarios, if the attacker can precisely control the overwritten return address, this vulnerability could potentially be leveraged for arbitrary code execution, although the primary reported impact is denial of service due to instability and crashes.
The operational impact of this vulnerability is significant for any system relying on GPAC or MP4Box for media processing, particularly in environments where untrusted content ingestion occurs. A successful exploitation allows an attacker to cause a Denial of Service by crashing the application that attempts to parse the malicious file. This can disrupt services such as video streaming platforms, media conversion pipelines, or digital asset management systems that automatically process incoming MP4 files. The lack of robust error handling for malformed BIFS nodes means that even simple exposure to a crafted file via email attachments, web uploads, or network streams can lead to service interruption and potential resource exhaustion if the application attempts to restart repeatedly without proper safeguards.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-121: Stack-based Buffer Overflow and CWE-787: Out-of-bounds Write on Untrusted Input. It also maps to MITRE ATT&CK techniques related to Initial Access via Spearphishing Attachment or Drive-by Compromise, where the malicious file serves as the initial vector for disrupting availability or potentially gaining further foothold if code execution is achieved. Mitigation strategies primarily involve upgrading to GPAC version 2.5 or later, which includes patches addressing these boundary checks and input validation mechanisms in the BIFS decoder. Additionally, organizations should implement strict input sanitization at network boundaries, employ sandboxing for media processing services, and utilize automated fuzzing tools during development cycles to detect similar stack-based vulnerabilities before deployment.