Description
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Published: 2026-10-21
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Update
AI Analysis

Impact

A segmentation violation occurs in the GetESD function of GPAC Project/MP4Box before version 2.5. When MP4Box processes a specially crafted MP4 file, the bug causes a crash, rendering the tool unavailable until restarted. The vulnerability is a classic memory corruption flaw that may lead to a denial of service for any user who runs MP4Box on the malicious file.

Affected Systems

GPAC Project/MP4Box versions prior to 2.5 are affected. Users running any legacy build of this media processing tool are at risk until a newer release is deployed.

Risk and Exploitability

The attack vector is conventional; a user can supply a crafted MP4 file to MP4Box and trigger the segmentation fault. Because the exploit simply causes a crash, it is a local denial of service, but if the tool is run on a shared system or exposed to untrusted input, it can affect availability for others. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.5, indicating a moderate severity impact.

Generated by OpenCVE AI on October 22, 2026 at 00:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC Project/MP4Box to version 2.5 or later
  • Disallow processing of unknown MP4 files with legacy MP4Box installations until the upgrade is applied
  • Consider running MP4Box in a sandboxed or isolated environment to contain any potential crashes

Generated by OpenCVE AI on October 22, 2026 at 00:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Thu, 22 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Segmentation Fault in GPAC MP4Box Causing Denial of Service

Wed, 21 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Title Segmentation Violation in GPAC Project/MP4Box Allowing Denial of Service

Wed, 21 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Title Segmentation Violation in GPAC Project/MP4Box Allowing Denial of Service
Weaknesses CWE-119

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
References

Subscriptions

Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-23T15:07:33.099Z

Reserved: 2025-09-26T00:00:00.000Z

Link: CVE-2025-60497

cve-icon Vulnrichment

Updated: 2026-10-23T15:07:33.099Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T15:17:14.280

Modified: 2026-10-28T14:10:00.220

Link: CVE-2025-60497

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:19:36Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer