Quick answers
- Is CVE-2025-60494 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-60494 being exploited in the wild.
- How severe is CVE-2025-60494?
- Informational severity, published 20 October 2026.
- Which products and versions are affected?
- GPAC Project MP4Box before 2.5.
- Is there a fix for CVE-2025-60494?
- Yes: fixed in GPAC 2.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-60494 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-60494?
- Check whether you run GPAC Project MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: GPAC 2.5
Technical details
A segmentation violation exists in the gf_props_equal_internal function within filter_core/filter_props.c when comparing PID property values. The vulnerability is triggered by supplying crafted media data containing malformed descriptors or property structures, leading to a read-access fault. An attacker can exploit this via a specially constructed MP4 file to cause a denial-of-service condition.
Affected products
- GPAC Project MP4Box before 2.5
Timeline
- 2025-09-03: disclosed
- 2026-10-20: advisory
- patched: Fix prevents const data properties from being passed as user-assigned PID properties