# GPAC Project MP4Box vulnerabilities Source: https://junglewise.ai/threats/technologies/gpac-project-mp4box Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gpac-project-mp4box.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in GPAC Project MP4Box: 0 in the last 7 days and 17 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-60476, was published on 21 October 2026. 17 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 17 - Last 90 days: 17 - All time: 17 (0 critical, 0 exploited in the wild) ## About GPAC Project MP4Box Multimedia framework tool for MP4 file manipulation and conversion from GPAC Project. ## Latest GPAC Project MP4Box vulnerabilities - [CVE-2025-60476: GPAC MP4Box heap use-after-free in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function) (info, published 21 Oct 2026) - [CVE-2025-60469: GPAC MP4Box NULL pointer dereference in AC4 parser](https://junglewise.ai/threats/cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode) (info, published 21 Oct 2026) - [CVE-2025-60497: GPAC MP4Box null pointer dereference in GetESD](https://junglewise.ai/threats/cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c) (info, published 21 Oct 2026) - [CVE-2025-60493: GPAC MP4Box segmentation violation in check_media_profile](https://junglewise.ai/threats/cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function) (info, published 21 Oct 2026) - [CVE-2025-60492: GPAC MP4Box stack overflow in BIFS scene decoder](https://junglewise.ai/threats/cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field) (info, published 21 Oct 2026) - [CVE-2025-60491: GPAC MP4Box heap use-after-free in dasher](https://junglewise.ai/threats/cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function) (info, published 21 Oct 2026) - [CVE-2025-60490: GPAC MP4Box heap use-after-free in filter event handling](https://junglewise.ai/threats/cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream) (info, published 21 Oct 2026) - [CVE-2025-60487: GPAC MP4Box segmentation violation in gf_isom_get_esd](https://junglewise.ai/threats/cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia) (info, published 21 Oct 2026) - [CVE-2025-60478: GPAC MP4Box use-after-free in packet destroy](https://junglewise.ai/threats/cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter) (info, published 21 Oct 2026) - [CVE-2025-71438: GPAC MP4Box out-of-bounds read in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c) (info, published 21 Oct 2026) - [CVE-2025-60489: GPAC MP4Box NULL pointer dereference in dasher timeline entry](https://junglewise.ai/threats/cve-2025-60489-a-null-pointer-dereference-in-the-dasher-insert-timeline-entry) (info, published 21 Oct 2026) - [CVE-2025-60479: GPAC MP4Box NULL pointer dereference in StatSFVec2f](https://junglewise.ai/threats/cve-2025-60479-a-null-pointer-dereference-in-the-statsfvec2f-function-scene) (info, published 21 Oct 2026) - [CVE-2025-60496: GPAC MP4Box floating-point exception in reframer](https://junglewise.ai/threats/cve-2025-60496-a-floating-point-exception-fpe-in-the-reframer-send-packet) (info, published 20 Oct 2026) - [CVE-2025-60494: GPAC MP4Box segmentation violation in gf_props_equal_internal](https://junglewise.ai/threats/cve-2025-60494-a-segmentation-violation-in-the-gf-props-equal-internal-function) (info, published 20 Oct 2026) - [CVE-2025-60475: GPAC MP4Box buffer overflow in AC4 parser](https://junglewise.ai/threats/cve-2025-60475-a-buffer-overflow-in-the-gf-ac4-parser-bs-function-media-tools-av) (info, published 20 Oct 2026) - [CVE-2025-60482: GPAC MP4Box heap use-after-free in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-60482-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function) (info, published 19 Oct 2026) - [CVE-2025-60480: GPAC MP4Box heap buffer overflow in AC4 parsing](https://junglewise.ai/threats/cve-2025-60480-a-heap-buffer-overflow-in-the-gf-odf-ac4-cfg-alternative-info) (info, published 19 Oct 2026) ## Most severe GPAC Project MP4Box vulnerabilities - [CVE-2025-60476: GPAC MP4Box heap use-after-free in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-60476-a-heap-use-after-free-in-the-gf-odf-ac4-cfg-clean-list-function) (info, published 21 Oct 2026) - [CVE-2025-60469: GPAC MP4Box NULL pointer dereference in AC4 parser](https://junglewise.ai/threats/cve-2025-60469-a-null-pointer-dereference-in-the-gf-ac4-presentation-ch-mode) (info, published 21 Oct 2026) - [CVE-2025-60497: GPAC MP4Box null pointer dereference in GetESD](https://junglewise.ai/threats/cve-2025-60497-a-segmentation-violation-in-the-getesd-function-isomedia-track-c) (info, published 21 Oct 2026) - [CVE-2025-60493: GPAC MP4Box segmentation violation in check_media_profile](https://junglewise.ai/threats/cve-2025-60493-a-segmentation-violation-in-the-check-media-profile-function) (info, published 21 Oct 2026) - [CVE-2025-60492: GPAC MP4Box stack overflow in BIFS scene decoder](https://junglewise.ai/threats/cve-2025-60492-a-stack-overflow-in-the-gf-bifs-dec-node-function-bifs-field) (info, published 21 Oct 2026) - [CVE-2025-60491: GPAC MP4Box heap use-after-free in dasher](https://junglewise.ai/threats/cve-2025-60491-a-heap-use-after-free-in-the-dasher-flush-segment-function) (info, published 21 Oct 2026) - [CVE-2025-60490: GPAC MP4Box heap use-after-free in filter event handling](https://junglewise.ai/threats/cve-2025-60490-a-heap-use-after-free-in-the-gf-filter-pid-send-event-downstream) (info, published 21 Oct 2026) - [CVE-2025-60487: GPAC MP4Box segmentation violation in gf_isom_get_esd](https://junglewise.ai/threats/cve-2025-60487-a-segmentation-violation-in-the-gf-isom-get-esd-function-isomedia) (info, published 21 Oct 2026) - [CVE-2025-60478: GPAC MP4Box use-after-free in packet destroy](https://junglewise.ai/threats/cve-2025-60478-a-use-after-free-in-the-gf-filter-packet-destroy-function-filter) (info, published 21 Oct 2026) - [CVE-2025-71438: GPAC MP4Box out-of-bounds read in AC4 descriptor parsing](https://junglewise.ai/threats/cve-2025-71438-an-out-of-bounds-read-in-gf-odf-ac4-cfg-dsi-v1-odf-descriptors-c) (info, published 21 Oct 2026) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 17 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GPAC Project MP4Box vulnerabilities", https://junglewise.ai/threats/technologies/gpac-project-mp4box, 9 November 2026.