CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete

CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file

Summary by Cyber Security News26 Oct 2026, 22:28 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/395

Posted by Alexander A. Shvedov on Oct 26 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60467 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel Description: The gf_filter_pid_inst_swap_delete_task() function in GPAC's filter session core (filter_core/filter_pid.c:574) is a scheduled task that deletes a...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

No need to hack when it’s leaking: Artex edition

ARTEX abuse expands as cybercriminals target financial sector

Re: "sshole": password authentication bypass: OpenSSH + musl libc

CVE-2026-118196: Apache Allura: OAuth1 rebinding

[oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10

InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds