Threats affecting pkg:github/gpac/gpac

CVE-2025-60476 is a heap use-after-free vulnerability in the gf_odf_ac4_cfg_clean_list function of GPAC Project/MP4Box versions before 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a crafted AC4 file. The issue is fixed in version 2.5.

CVE-2025-60469 is a vulnerability in GPAC Project/MP4Box before version 2.5 where a NULL pointer dereference occurs in the gf_ac4_presentation_ch_mode function. This flaw can be triggered by supplying a crafted AC4 file, resulting in a denial of service (DoS) condition.

CVE-2025-60492 is a stack-based buffer overflow vulnerability in the gf_bifs_dec_node function of GPAC Project/MP4Box versions before 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a specially crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-60490 is a heap use-after-free vulnerability in the gf_filter_pid_send_event_downstream function of GPAC Project/MP4Box before version 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a specially crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-60487 is a vulnerability in GPAC Project/MP4Box before version 2.5 where a NULL pointer dereference in the gf_isom_get_esd function can cause a denial of service. This occurs when processing a crafted XML file, leading to a segmentation violation and application crash.

CVE-2025-60478 is a use-after-free vulnerability in the gf_filter_packet_destroy function of GPAC Project/MP4Box before version 2.5. This flaw can be triggered by processing a crafted MPEG-2 file, leading to a denial of service (DoS) condition. The issue is fixed in version 2.5.

CVE-2025-60497 is a medium severity vulnerability in GPAC Project/MP4Box before version 2.5. It involves a segmentation violation in the GetESD function within the /isomedia/track.c file. An attacker can trigger a Denial of Service (DoS) by supplying a crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-60493 is a vulnerability in GPAC Project's MP4Box before version 2.5 that causes a NULL pointer dereference in the check_media_profile function. This flaw can be triggered by processing a crafted MP4 file, resulting in a denial of service (DoS) due to a segmentation violation.

CVE-2025-60491 is a heap use-after-free vulnerability in the dasher_flush_segment function of GPAC Project/MP4Box versions prior to 2.5. This flaw allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-60479 is a vulnerability in GPAC Project/MP4Box before version 2.5 where a NULL pointer dereference occurs in the StatSFVec2f function. This flaw can be triggered by processing a specially crafted MPEG-4 file, resulting in a denial of service (DoS) condition. The issue is fixed in version 2.5.

CVE-2025-71438 is an out-of-bounds read vulnerability in the GPAC Project's MP4Box component prior to version 26.07.0. The flaw exists in the gf_odf_ac4_cfg_dsi_v1 function within the /odf/descriptors.c file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 file. This vulnerability has a medium severity rating with a CVSS score of 5.5. The issue is fixed in version 26.07.0.

CVE-2025-60489 is a vulnerability in GPAC Project/MP4Box before version 2.5 where a NULL pointer dereference occurs in the dasher_insert_timeline_entry function. This flaw can be triggered by processing a crafted MP4 file, leading to a denial of service (DoS) condition. The issue is fixed in version 2.5.

CVE-2025-60475 is a buffer overflow vulnerability in the gf_ac4_parser_bs function of GPAC Project/MP4Box versions before 2.5. This flaw allows an attacker to cause a denial of service (DoS) by supplying crafted input. The issue is fixed in version 2.5.

CVE-2025-60496 is a vulnerability in GPAC Project/MP4Box before version 2.5 where a floating-point exception occurs in the reframer_send_packet function. This flaw can be triggered by processing a specially crafted MP4 file, leading to a denial of service condition.

CVE-2025-60494 is an out-of-bounds write vulnerability in the GPAC Project's MP4Box component before version 2.5. It occurs in the gf_props_equal_internal function, leading to a segmentation violation when processing crafted data files. This flaw allows attackers to cause a denial of service (DoS) by crashing the application.