CVE-2025-60482

CVE-2025-60482

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00166 · 5.6th percentile
Published
2026-10-19T23:17Z
References (3)
https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b · [email protected]https://github.com/gpac/gpac/issues/3297 · [email protected]https://infosec.exchange/@sigdevel/117456522954593448 · [email protected]
EPSS history
Timeline
  • 21 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 19 OCT 00:00Z
    A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers…
    cvelistv5
  • 19 OCT 00:00Z
    A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers…
    cvelistv5