Description
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Published: 2026-10-21
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A heap use‑after‑free flaw (CWE‑416) occurs in the dasher_flush_segment function of the GPAC Project MP4Box tool. When a specially crafted MP4 file is processed, the software frees a memory buffer and later attempts to access it again. This triggers a crash that interrupts the tool’s operation but does not provide code execution or privilege escalation.

Affected Systems

The vulnerability impacts the GPAC Project MP4Box utility on any platform before release 2.5. Users running older versions of this media processing library are susceptible; newer releases are not affected.

Risk and Exploitability

The attack requires supplying a malicious MP4 file to the MP4Box process. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the issue is not listed in CISA KEV. The potential for a denial of service exists as the errant code path lacks proper checks. Because the flaw is a classic use‑after‑free, a local or remote attacker who can influence input file parsing can reliably trigger the crash. The CVSS score is 5.5, indicating moderate severity.

Generated by OpenCVE AI on October 27, 2026 at 01:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install GPAC MP4Box version 2.5 or later, which removes the use‑after‑free.
  • If an update can’t be applied immediately, run MP4Box in a sandbox or isolated environment to contain any crash.
  • Configure file validation to reject MP4 files that violate upstream standards, limiting the opportunity to supply a crafted payload.

Generated by OpenCVE AI on October 27, 2026 at 01:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title MP4Box Heap Use‑After‑Free Allows Denial of Service

Mon, 26 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
References

Thu, 22 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title MP4Box Heap Use‑After‑Free Allows Denial of Service
Weaknesses CWE-416

Thu, 22 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Title Heap Use-After-Free in GPAC MP4Box Leads to Denial of Service
Weaknesses CWE-416

Wed, 21 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Wed, 21 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Title Heap Use-After-Free in GPAC MP4Box Leads to Denial of Service
Weaknesses CWE-416

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
References

Subscriptions

Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-26T19:40:28.664Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-60491

cve-icon Vulnrichment

Updated: 2026-10-23T15:07:29.849Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T15:17:13.867

Modified: 2026-10-28T14:10:00.220

Link: CVE-2025-60491

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T01:30:16Z

Weaknesses