Quick answers
- Is CVE-2025-60480 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-60480 being exploited in the wild.
- How severe is CVE-2025-60480?
- Informational severity, published 19 October 2026.
- Which products and versions are affected?
- GPAC Project MP4Box 2.5-DEV-rev1593-gfe88c354 and earlier.
- Is there a fix for CVE-2025-60480?
- Yes: fixed in Version after commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b (2025-07-15). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-60480 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-60480?
- Check whether you run GPAC Project MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Version after commit e02d1fd24cdc26acb1b236ab38b3832cffcae21b (2025-07-15)
Technical details
The gf_odf_ac4_cfg_alternative_info function in odf/descriptors.c performs insufficient bounds checking on alt_group_id array indices, leading to a heap buffer overflow when processing AC4 audio descriptor structures. An attacker can trigger this via a malformed AC4 file parsed by MP4Box; the vulnerability requires only the ability to provide input to the tool and causes denial of service with potential for code execution.
Affected products
- GPAC Project MP4Box 2.5-DEV-rev1593-gfe88c354 and earlier
Timeline
- 2025-10-19: disclosed
- 2025-07-15: patched: Commit e02d1fd fixing AC4 fuzzing issues