early signals oss-security

CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input

// summary

A heap use-after-free vulnerability in GPAC MP4Box can be triggered by crafted MPEG-2 Transport Stream input and has been assigned CVE-2025-60490.

// from the source

Posted by Alexander A. Shvedov on Oct 23 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: d0793f92e04fe284a25c2a9335cc5edc68deb6d4 CVE: CVE-2025-60490 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel) Description: MP4Box contains a heap use-after-free in...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    Ruby Regexp compilation fixes related to GitLab's CVE's

    seclists.org
  2. oss-security infra

    PHP Informational advisory: Session upload progress (CVE-2026-115560)

    seclists.org
  3. oss-security

    CVE-2026-115748: Apache Vysper: Authorization bypass

    seclists.org
  4. oss-security

    CVE-2026-115721: Apache Vysper: Unbounded allocation

    seclists.org
  5. oss-security

    CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input

    seclists.org