early signals oss-security

CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

// AI summary

GPAC (MP4Box) has a Heap Use-After-Free vulnerability, CVE-2025-60482, affecting version 2.5-DEV-rev1593-gfe88c3545-master, which is fixed in commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b.

// from the source

Posted by Alexander A. Shvedov on Oct 29 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master (confirmed) Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b (upstream commit) CVE: CVE-2025-60482 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CISA ADP assessment in the CVE record) Reporter: Alexander A. Shvedov (@sigdevel) Description:...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  3. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  4. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org
  5. oss-security infra

    CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames

    seclists.org