CVE-2025-60468 describes a heap use-after-free vulnerability in GPAC's MP4Box tool, specifically in the filter_core/filter_pid.c source file within the gf_filter_pid_inst_swap_delete_task() function. This function improperly accesses freed memory during cleanup of PID instances after swap or delete operations. A local attacker with authentication privileges can trigger this flaw by processing a maliciously crafted MPEG-2 TS or MP4 file, leading to a crash of the application. The vulnerability results in a denial of service condition. No CVSS score or vendor advisory is available, and no patch or fix has been documented.

The vulnerability allows a local, authenticated user to cause a denial of service by crashing MP4Box when processing specially crafted media files. The crash results from a heap use-after-free condition during filter teardown. While denial of service is confirmed, the possibility of further exploitation is mentioned but not detailed or confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted MPEG-2 TS or MP4 files with MP4Box, especially in environments where local authenticated users may be untrusted.