CVE-2025-60468

Name of the Vulnerable Software and Affected Versions MP4Box version 2.5-DEV-rev1593-gfe88c3545-master

Description A heap use-after-free occurs when the gf filter pid inst swap delete task() function in the filter core/filter pid.c component improperly accesses objects after they have been freed during the cleanup of PID instances following a swap or delete operation. A local authenticated user can trigger this issue by processing a specially crafted MPEG-2 TS or MP4 file, which may lead to a crash and a local denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.