The vulnerability identified as CVE-2025-60465 affects GPAC Project/MP4Box versions prior to 26.02.0. It is a use-after-free issue in the gf_filter_pid_inst_swap function located in /filter_core/filter_pid.c. Exploitation requires supplying a specially crafted media file, which can trigger a Denial of Service condition. The CVSS 3.1 vector indicates the attack vector is local (AV:L), with low attack complexity (AC:L), no privileges required (PR:N), and requires user interaction (UI:R). The impact includes low confidentiality impact, high integrity impact, and no availability impact. There is no known exploit in the wild and no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can cause a Denial of Service by triggering a use-after-free condition, potentially crashing the application or causing unexpected behavior. The confidentiality impact is low, integrity impact is high, and availability impact is none according to the CVSS vector. No evidence of exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or suspicious media files with affected versions of GPAC Project/MP4Box.