CVE-2025-60476 security flaw

Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60476 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel) Description: MP4Box contains a heap use-after-free in gf_odf_ac4_cfg_clean_list() in...

Published 22-Oct-2026 21:16 UTC · First seen 22-Oct-2026 21:14 UTC

Sources

• Open Source Security · 22-Oct-2026