Posted by Alexander A. Shvedov on Oct 27 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60475 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: Not assessed Reporter: sigdevel Description: The gf_ac4_parser_bs() function in GPAC's AC-4 parser (media_tools/av_parsers.c:16140) accesses AC4_SAMPLE_DELTA_TABLE_48 using a frame_rate_index read from the input stream without proper...
CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/409
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
AbuseBox: Open-source monitor for blacklists, DNS, SSL and email records
AbuseBox is a free, open-source tool that checks IP addresses and domains against 60 DNS blacklists, pulls reputation scores from AbuseIPDB, inspects DNS, SSL and…
SpecGuard: Detecting Multi-Turn LLM Jailbreaks via Specification-Based Runtime Monitoring
arXiv:2610.36258v1 Announce Type: new Abstract: Multi-turn jailbreaks turn dialogue safety into a trace property: a violation may become identifiable only when user…
Re: Information for Python users regarding eMudhra / emSign CA certificate security incident
Posted by Kevin Riggle on Oct 27 The discuss.python.org conversation on that issue has long since moved on, so asking here: The macOS remediation advice on the official…
Vulnerabilities in golang.org/x/net
Posted by Alan Coopersmith on Oct 27 Forwarded Message Subject: [security] Vulnerabilities in golang.org/x/net Date: Tue, 27 Oct 2026 19:53:49 +0000 From: announce ()…
Before you file that AI bug report, OpenAI has some advice
Even OpenAI is admitting there is a lot of AI slop in the security space. An executive for the frontier AI company said Tuesday that AI-generated vulnerability reports…
Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow
Posted by Tomasz Kaye on Oct 27 A remote denial-of-service vulnerability in Godot's DTLS networking was publicly disclosed on 2026-10-27 [1]. Affected versions: Godot…