CVE-2025-60464

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-60464
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60464.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-60464
Downstream
Published
2026-06-25T00:00:00Z
Modified
2026-08-12T15:14:17.262030Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A use-after-free in the gfseiloadfromstateinternal function (/filters/seiload.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60464.json"
}
References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
118e60a905878e56dc4f9c5b309143c5f447c702
Fixed
8f404bd581e455267482f86272169a742f654b97
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "26.02.0"
        }
    ]
}

Affected versions

Other
abi-12
abi-13
abi-14
abi-15
abi-16
abi-12.*
abi-12.16
abi-12.17
abi-12.18
abi-12.19
abi-12.20
abi-12.21
abi-12.22
abi-12.23
abi-12.24
abi-12.25
abi-12.26
abi-12.27
abi-13.*
abi-13.0
abi-14.*
abi-14.0
abi-15.*
abi-15.0
abi-15.1
abi-15.2
abi-16.*
abi-16.2
abi-16.3
abi-16.4
abi-16.5
testtag0.*
testtag0.1
v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60464.json"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "49693748215693631872447578373367731882",
            "length": 2616.0
        },
        "target": {
            "function": "seiloader_set_type",
            "file": "src/filters/sei_load.c"
        },
        "source": "https://github.com/gpac/gpac/commit/8f404bd581e455267482f86272169a742f654b97",
        "signature_version": "v1",
        "id": "CVE-2025-60464-ed77e975",
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "54792072329502583052370657150482281222",
                "113923329731236963033572983632798500881",
                "206858496126925950541822729101194197724",
                "321637923236465046872521867390539641084",
                "184481426072328363434304090534559702060",
                "154524781352436352901985007946385011926",
                "97576296246524286410891166237169323730",
                "306799349474881298798766346406975687051",
                "72331594068485451104336984536319707135",
                "175391239003993196981560632092618505037",
                "151340973027622855503437008397189476882",
                "178784446274947581424476429123048410650",
                "275388182899313653723601035851493758113",
                "243542334422085899996538879437529848032",
                "151367242797750246189344950861852274576",
                "80266027288644848331591874278803988859",
                "219972307940994528440024836233884791120",
                "203295302110420639760100719965040945713",
                "73263355130085709009943253428318406513",
                "171449230873672252940110685513815487068",
                "118462360540725295586593356078498144908",
                "231747856280199105318158645333291259569",
                "174952797109196690714240755663370764146",
                "321757284596049259956722928714954068603",
                "258902321437331716181938073257612941125",
                "83648310624598573148890930103785342358",
                "99721285489233092319368193747113489014",
                "233626963259921174673022671199876306347",
                "94641407082508893881389154958109956124",
                "299167444091132589636408359192640054363",
                "175798834561779079314730921442743265175",
                "232199088620166765547838654644862893259",
                "173067835095402200427527725228661772422",
                "254934527417496114130874234696831255352",
                "82448035537794225111816737789465452801"
            ]
        },
        "target": {
            "file": "src/filters/sei_load.c"
        },
        "source": "https://github.com/gpac/gpac/commit/8f404bd581e455267482f86272169a742f654b97",
        "signature_version": "v1",
        "id": "CVE-2025-60464-f0bbd833",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-12T15:14:17Z"