{"id":"CVE-2025-60486","details":"A heap use-after-free in the dasher_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.","modified":"2026-07-09T18:18:32.589899Z","published":"2026-06-01T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60486.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/01/12"},{"type":"WEB","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/53/README.md"},{"type":"WEB","url":"https://infosec.exchange/@sigdevel/116662544397024289"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60486.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60486"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3314"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"118e60a905878e56dc4f9c5b309143c5f447c702"},{"fixed":"e6d01820d7bf3967d931fedb379ee5f209bc133b"}],"database_specific":{"extracted_events":[{"introduced":"MP4Box"},{"fixed":"26.02.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-3b557214","digest":{"function_hash":"199193566362182277671567014971897598992","length":27175},"target":{"file":"src/filters/dasher.c","function":"dasher_configure_pid"},"signature_type":"Function"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-44068655","digest":{"threshold":0.9,"line_hashes":["18932393730742255432453235775156873288","270764964189030152645070470071380676127","203278179028737446463915301054632003726","26470146062633646409700590501854041123"]},"target":{"file":"applications/mp4box/filedump.c"},"signature_type":"Line"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-9537c0f7","digest":{"threshold":0.9,"line_hashes":["317538733772543257714868350721726851573","137681394362777990054220572964002058179","142975858742031049477880172076800051828","203598634951213534465747330965941789001","163716403421700846906667530234405621781","317986557153736425087238008084793996035","238519764834600678469054849651481763603","93227704173811863791141511083492932459","88791466694522139178564174306992216343","103019590927704249470899543114139376321","77841915592605315089333655969047531240","154038803093701615408291907311435998544","262975630474639848023276571725028318126","280175335559217037197328790295620441384","29261712364992840501577639974975309736","198518410689237081419018262826185960088","261003641882765732018676017977844923181","102945830147294261733650850005714985781","70196362472973435179664887836685463438","98136200847790978478183906301048952944","148220903167292014333896411881072894254","112743802115215259457116489040444028229","314290810626926821994804814259417773724","106407875581277610765102174148391597028","22108762012841155499484521830349600840","7179292035962996126116823087877580176","327611018766656538872449455059416753972","130656830246720395881826214564943429671","54622022950901821246888125045551280937","225295717380783183469772857211377099329","293423430594466348730012397236555846876","42302748561924312812961428263952810263","198699169140994778824602578411698069490","176949747484912305936256339836182072158"]},"target":{"file":"src/filters/dasher.c"},"signature_type":"Line"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-a29bd9f3","digest":{"function_hash":"72938795741503737622083433653794534487","length":2028},"target":{"file":"applications/mp4box/filedump.c","function":"dump_isom_saps"},"signature_type":"Function"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-a5d38257","digest":{"threshold":0.9,"line_hashes":["242170403633445511533484490383533956107","123559476618757254484850121810495946772","274232141822084879926864990161210122112","144407673426189294790732282237281067418"]},"target":{"file":"src/isomedia/isom_read.c"},"signature_type":"Line"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-a788a807","digest":{"threshold":0.9,"line_hashes":["123651366942589291184106866356819776233","309068702292035141079474280135500620950","146885122247678406655456477415361815509","206138803660333225707896228933792087808"]},"target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c"},"signature_type":"Line"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-b16f5372","digest":{"function_hash":"312013340158895046591627719361534586937","length":319},"target":{"file":"src/isomedia/isom_read.c","function":"gf_isom_get_esd"},"signature_type":"Function"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","deprecated":false,"signature_version":"v1","id":"CVE-2025-60486-c80451ae","digest":{"function_hash":"14270339333290916441435841127438430668","length":1509},"target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c","function":"TraverseIFS2D"},"signature_type":"Function"}],"vanir_signatures_modified":"2026-07-09T18:18:32Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60486.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}