CVE-2025-60478 security flaw

Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1617-g856674b22-master Commit 856674b226d6cbe28a941ad223be38194cbf7d37 Fixed: c592a144bbe339ee581ca88aaa3247362795b742 CVE: CVE-2025-60478 CWE: CWE-416 (Use After Free) CVSS 3.1: 7.8 HIGH (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel) Description: MP4Box contains a heap use-after-free in gf_filter_packet_destroy() at...

Published 22-Oct-2026 21:16 UTC · First seen 22-Oct-2026 21:14 UTC

Sources

• Open Source Security · 22-Oct-2026