CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

Summary by Cyber Security News29 Oct 2026, 17:57 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/435

Posted by Alexander A. Shvedov on Oct 29 Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master (confirmed) Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b (upstream commit) CVE: CVE-2025-60482 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CISA ADP assessment in the CVE record) Reporter: Alexander A. Shvedov (@sigdevel) Description:...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.