Is CVE-2025-60490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60490 being exploited in the wild.

How severe is CVE-2025-60490?

Informational severity, published 21 October 2026.

Which products and versions are affected?

GPAC Project MP4Box before 2.5.

Is there a fix for CVE-2025-60490?

Yes: fixed in GPAC 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-60490 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-60490?

Check whether you run GPAC Project MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60490: GPAC MP4Box heap use-after-free in filter event handling

CVE-2025-60490 · Severity: info · Published 2026-10-21

GPAC's MP4Box is a multimedia processing tool that handles audio and video files. A heap use-after-free vulnerability in its filter system can be triggered by processing a specially crafted MP4 or Transport Stream file, causing the application to crash and potentially enabling arbitrary code execution. An attacker can exploit this by supplying a malicious file to a user or service running MP4Box.

Technologies: GPAC Project MP4Box. Vendors: GPAC Project.

Quick answers

Is CVE-2025-60490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60490 being exploited in the wild.
How severe is CVE-2025-60490?: Informational severity, published 21 October 2026.
Which products and versions are affected?: GPAC Project MP4Box before 2.5.
Is there a fix for CVE-2025-60490?: Yes: fixed in GPAC 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-60490 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-60490?: Check whether you run GPAC Project MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GPAC 2.5

Technical details

The gf_filter_pid_send_event_downstream function in filter_core/filter_pid.c attempts to access a PID (Packet Identifier) object after it has been freed during earlier parsing errors. The vulnerability occurs when processing malformed Transport Stream data where PID instances are removed due to chain swaps, but the event handler does not check for this condition before dereferencing the freed memory. The fix adds a check for the swap_source flag to skip processing freed PID instances.

Affected products

GPAC Project MP4Box before 2.5

Timeline

2025-07-29: disclosed
2025-09-09: patched: Fix committed as d0793f92e04fe284a25c2a9335cc5edc68deb6d4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.