CVE-2025-60474

HighCVSS 7.5

Published: 24/06/2026(UTC)Updated: 29/06/2026(UTC)Translated: 30/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

41th percentile — higher than 41% of all known CVEs

Summary

A buffer overflow vulnerability in the gf_media_import function of GPAC/MP4Box before version 26.02.0 allows an attacker to cause a Denial of Service (DoS) by supplying a crafted input file.

Risk Assessment

An attacker can remotely crash the MP4Box application, disrupting multimedia processing services and potentially causing availability loss.

Recommendation

Immediately update GPAC/MP4Box to version 26.02.0 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.