CVE-2025-60464
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile — higher than 4% of all known CVEs
Summary
A use-after-free vulnerability was found in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted MPEG-2 TS file.
Risk Assessment
The risk is that an attacker can remotely crash the MP4Box application by providing a malicious multimedia file, potentially disrupting media processing systems.
Recommendation
It is recommended to immediately update GPAC/MP4Box to version 26.02.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.