CVE-2025-60497 in MP4Box
Summary
by MITRE • 10/21/2026
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the GPAC Project's MP4Box utility, specifically in versions prior to 2.5, represents a critical memory safety issue rooted in improper handling of input data during media parsing operations. The core technical flaw resides within the GetESD function located in the /isomedia/track.c source file. This component is responsible for extracting and processing Elementary Stream Descriptor (ESD) information from MP4 container files. When an attacker supplies a specially crafted, malformed MP4 file containing invalid or maliciously structured ESD data, the application fails to perform adequate bounds checking or validation of memory pointers associated with these descriptors. Consequently, this lack of rigorous input sanitization leads directly to a segmentation violation, commonly known as a segfault, which occurs when the program attempts to access memory that it is not permitted to access.
From an operational perspective, the primary impact of this vulnerability is a Denial of Service against users or automated systems relying on MP4Box for media processing tasks such as conversion, analysis, or streaming preparation. Because the flaw triggers a crash rather than allowing arbitrary code execution in its current manifestation, the immediate consequence is the termination of the application process. In environments where MP4Box operates continuously, such as in content delivery networks, automated video transcoding pipelines, or digital asset management systems processing user-uploaded media, this vulnerability can be exploited to disrupt service availability. Attackers can repeatedly submit crafted files to exhaust system resources by causing frequent restarts or simply rendering the specific instance of the software unusable until a manual intervention occurs.
This type of memory corruption issue aligns with CWE-125, Out-of-bounds Read, and potentially CWE-787, Out-of-bounds Write, depending on the exact nature of the pointer dereference that causes the segmentation fault. The exploitation vector falls under MITRE ATT&CK technique T1496, Resource Hijacking, specifically through denial of service via resource exhaustion or application crash. While the immediate effect is a crash, such memory safety vulnerabilities often serve as precursors to more severe exploits if similar patterns exist elsewhere in the codebase that could be manipulated for buffer overflows leading to remote code execution. Therefore, treating this not just as an availability issue but as part of a broader class of unsafe memory management practices is prudent from a security engineering standpoint.
Mitigation strategies must prioritize immediate patching and defensive coding practices. The most effective remediation is upgrading the GPAC Project/MP4Box software to version 2.5 or later, where this specific flaw in the GetESD function has been addressed through improved input validation and memory safety checks. For organizations unable to upgrade immediately due to dependency constraints, implementing strict file type verification and sandboxing of media processing tools can reduce exposure. Additionally, deploying intrusion detection systems that monitor for abnormal process termination patterns associated with MP4Box may help in identifying active exploitation attempts. Developers should also conduct code reviews focusing on all functions handling external binary data to ensure consistent application of bounds checking and pointer validation protocols across the entire codebase.