{"schema_version":1,"title":"GPAC Project MP4Box vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in GPAC Project MP4Box: 0 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-60476, was published on 21 October 2026. 17 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/gpac-project-mp4box","json_url":"https://junglewise.ai/threats/technologies/gpac-project-mp4box.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/gpac-project-mp4box","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":17,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":17,"last_90_days":17,"last_365_days":17},"latest":[{"cve":"CVE-2025-60476","slug":"cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function","title":"GPAC MP4Box heap use-after-free in AC4 descriptor parsing","severity":"info","exploited":false,"published_at":"2026-10-21T16:17:13.55+00:00","url":"https://junglewise.ai/threats/cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function"},{"cve":"CVE-2025-60469","slug":"cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode","title":"GPAC MP4Box NULL pointer dereference in AC4 parser","severity":"info","exploited":false,"published_at":"2026-10-21T16:17:13.43+00:00","url":"https://junglewise.ai/threats/cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode"},{"cve":"CVE-2025-60497","slug":"cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c","title":"GPAC MP4Box null pointer dereference in GetESD","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:14.28+00:00","url":"https://junglewise.ai/threats/cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c"},{"cve":"CVE-2025-60493","slug":"cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function","title":"GPAC MP4Box segmentation violation in check_media_profile","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:14.14+00:00","url":"https://junglewise.ai/threats/cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function"},{"cve":"CVE-2025-60492","slug":"cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field","title":"GPAC MP4Box stack overflow in BIFS scene decoder","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.997+00:00","url":"https://junglewise.ai/threats/cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field"},{"cve":"CVE-2025-60491","slug":"cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function","title":"GPAC MP4Box heap use-after-free in dasher","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.867+00:00","url":"https://junglewise.ai/threats/cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function"},{"cve":"CVE-2025-60490","slug":"cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream","title":"GPAC MP4Box heap use-after-free in filter event handling","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.727+00:00","url":"https://junglewise.ai/threats/cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream"},{"cve":"CVE-2025-60487","slug":"cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia","title":"GPAC MP4Box segmentation violation in gf_isom_get_esd","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.58+00:00","url":"https://junglewise.ai/threats/cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia"},{"cve":"CVE-2025-60478","slug":"cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter","title":"GPAC MP4Box use-after-free in packet destroy","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.437+00:00","url":"https://junglewise.ai/threats/cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter"},{"cve":"CVE-2025-71438","slug":"cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c","title":"GPAC MP4Box out-of-bounds read in AC4 descriptor parsing","severity":"info","exploited":false,"published_at":"2026-10-21T14:17:07.503+00:00","url":"https://junglewise.ai/threats/cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c"},{"cve":"CVE-2025-60489","slug":"cve-2025-60489-a-null-pointer-dereference-in-the-dasher-insert-timeline-entry","title":"GPAC MP4Box NULL pointer dereference in dasher timeline entry","severity":"info","exploited":false,"published_at":"2026-10-21T14:17:07.333+00:00","url":"https://junglewise.ai/threats/cve-2025-60489-a-null-pointer-dereference-in-the-dasher-insert-timeline-entry"},{"cve":"CVE-2025-60479","slug":"cve-2025-60479-a-null-pointer-dereference-in-the-statsfvec2f-function-scene","title":"GPAC MP4Box NULL pointer dereference in StatSFVec2f","severity":"info","exploited":false,"published_at":"2026-10-21T14:17:06.957+00:00","url":"https://junglewise.ai/threats/cve-2025-60479-a-null-pointer-dereference-in-the-statsfvec2f-function-scene"},{"cve":"CVE-2025-60496","slug":"cve-2025-60496-a-floating-point-exception-fpe-in-the-reframer-send-packet","title":"GPAC MP4Box floating-point exception in reframer","severity":"info","exploited":false,"published_at":"2026-10-20T22:17:42.997+00:00","url":"https://junglewise.ai/threats/cve-2025-60496-a-floating-point-exception-fpe-in-the-reframer-send-packet"},{"cve":"CVE-2025-60494","slug":"cve-2025-60494-a-segmentation-violation-in-the-gf-props-equal-internal-function","title":"GPAC MP4Box segmentation violation in gf_props_equal_internal","severity":"info","exploited":false,"published_at":"2026-10-20T22:17:42.877+00:00","url":"https://junglewise.ai/threats/cve-2025-60494-a-segmentation-violation-in-the-gf-props-equal-internal-function"},{"cve":"CVE-2025-60475","slug":"cve-2025-60475-a-buffer-overflow-in-the-gf-ac4-parser-bs-function-media-tools-av","title":"GPAC MP4Box buffer overflow in AC4 parser","severity":"info","exploited":false,"published_at":"2026-10-20T22:17:42.747+00:00","url":"https://junglewise.ai/threats/cve-2025-60475-a-buffer-overflow-in-the-gf-ac4-parser-bs-function-media-tools-av"},{"cve":"CVE-2025-60482","slug":"cve-2025-60482-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function","title":"GPAC MP4Box heap use-after-free in AC4 descriptor parsing","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:03.65+00:00","url":"https://junglewise.ai/threats/cve-2025-60482-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function"},{"cve":"CVE-2025-60480","slug":"cve-2025-60480-a-heap-buffer-overflow-in-the-gf-odf-ac4-cfg-alternative-info","title":"GPAC MP4Box heap buffer overflow in AC4 parsing","severity":"info","exploited":false,"published_at":"2026-10-19T18:16:58.48+00:00","url":"https://junglewise.ai/threats/cve-2025-60480-a-heap-buffer-overflow-in-the-gf-odf-ac4-cfg-alternative-info"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":17},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"GPAC Project MP4Box","slug":"gpac-project-mp4box","vendor":{"hub":true,"name":"GPAC Project","slug":"gpac-project","url":"https://junglewise.ai/threats/vendors/gpac-project"},"aliases":[],"category":"multimedia-tool","homepage":"https://gpac.io/","description":"Multimedia framework tool for MP4 file manipulation and conversion from GPAC Project.","url":"https://junglewise.ai/threats/technologies/gpac-project-mp4box"},"most_severe":[{"cve":"CVE-2025-60476","slug":"cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function","title":"GPAC MP4Box heap use-after-free in AC4 descriptor parsing","severity":"info","exploited":false,"published_at":"2026-10-21T16:17:13.55+00:00","url":"https://junglewise.ai/threats/cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function"},{"cve":"CVE-2025-60469","slug":"cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode","title":"GPAC MP4Box NULL pointer dereference in AC4 parser","severity":"info","exploited":false,"published_at":"2026-10-21T16:17:13.43+00:00","url":"https://junglewise.ai/threats/cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode"},{"cve":"CVE-2025-60497","slug":"cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c","title":"GPAC MP4Box null pointer dereference in GetESD","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:14.28+00:00","url":"https://junglewise.ai/threats/cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c"},{"cve":"CVE-2025-60493","slug":"cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function","title":"GPAC MP4Box segmentation violation in check_media_profile","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:14.14+00:00","url":"https://junglewise.ai/threats/cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function"},{"cve":"CVE-2025-60492","slug":"cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field","title":"GPAC MP4Box stack overflow in BIFS scene decoder","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.997+00:00","url":"https://junglewise.ai/threats/cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field"},{"cve":"CVE-2025-60491","slug":"cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function","title":"GPAC MP4Box heap use-after-free in dasher","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.867+00:00","url":"https://junglewise.ai/threats/cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function"},{"cve":"CVE-2025-60490","slug":"cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream","title":"GPAC MP4Box heap use-after-free in filter event handling","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.727+00:00","url":"https://junglewise.ai/threats/cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream"},{"cve":"CVE-2025-60487","slug":"cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia","title":"GPAC MP4Box segmentation violation in gf_isom_get_esd","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.58+00:00","url":"https://junglewise.ai/threats/cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia"},{"cve":"CVE-2025-60478","slug":"cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter","title":"GPAC MP4Box use-after-free in packet destroy","severity":"info","exploited":false,"published_at":"2026-10-21T15:17:13.437+00:00","url":"https://junglewise.ai/threats/cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter"},{"cve":"CVE-2025-71438","slug":"cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c","title":"GPAC MP4Box out-of-bounds read in AC4 descriptor parsing","severity":"info","exploited":false,"published_at":"2026-10-21T14:17:07.503+00:00","url":"https://junglewise.ai/threats/cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}