GPAC 2.5-DEV-rev1593-gfe88c3545-master MP4Box filter_core/filter_pid.c gf_filter_pid_inst_swap_delete_task use after free

Summaryinfo

A vulnerability, which was classified as critical, has been found in GPAC 2.5-DEV-rev1593-gfe88c3545-master. Affected by this issue is the function gf_filter_pid_inst_swap_delete_task of the file filter_core/filter_pid.c of the component MP4Box. Performing a manipulation results in use after free. This vulnerability is known as CVE-2025-60468. Attacking locally is a requirement. Furthermore, an exploit is available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in GPAC 2.5-DEV-rev1593-gfe88c3545-master. It has been classified as critical. This affects the function gf_filter_pid_inst_swap_delete_task of the file filter_core/filter_pid.c of the component MP4Box. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filter_core/filter_pid.c (L:574-580): function gf_filter_pid_inst_swap_delete_task() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gf_filter_pid_inst_swap_delete_task() in filter_core/filter_pid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-60468 since 09/26/2025. The exploitability is told to be easy. An attack has to be approached locally. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept.

Applying the patch 976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Multimedia Player Software

Name

• GPAC

Version

• 2.5-DEV-rev1593-gfe88c3545-master

License

• open-source

Website

• Product: https://github.com/gpac/gpac/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion