[<prev] [next>] [day] [month] [year] [list]
Message-ID: <trinity-00f7ac88-5044-4b60-8967-48b956e032be-1780349152227@3c-app-mailcom-bs08>
Date: Mon, 1 Jun 2026 23:25:52 +0200
From: "Alexander A. Shvedov" <shvedov@....com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-60486: Use-After-Free in GPAC/MP4Box via dasher_process on
crafted MPEG-2 TS file
Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 (GPAC version 2.5-DEV-rev1665-g3f20eb0cd-master)
CVE: CVE-2025-60486
CWE: CWE-416 (Use After Free)
CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The dasher_configure_pid function in filters/dasher.c frees a PID context
structure at line 976 when reconfiguring a stream during DASH segmentation.
The freed pointer is not cleared after deallocation, and dasher_process
subsequently accesses the same memory region at line 9445 during the next
processing cycle, creating a heap use-after-free condition.
A crafted MPEG-2 TS file with repeated sync marker violations, broken PMT
descriptor sizes, and conflicting PID assignments triggers the reconfiguration
sequence that exposes the stale pointer. The subsequent READ of 4 bytes at
316 bytes into the freed 1096-byte region terminates the process. Code execution
cannot be ruled out; use-after-free vulnerabilities can allow an attacker to
control freed memory contents and redirect execution flow.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
-Command: ./MP4Box -dash 100 53_dasher_process_filters_dasher_c_9445
Asan-log:
==55065==ERROR: AddressSanitizer: heap-use-after-free on address 0x519000022cbc at pc 0x7f2fc41c3300 bp 0x7ffe86651b00 sp 0x7ffe86651af8
==55065==The signal is caused by a READ memory access.
#0 0x7f2fc41c32ff in dasher_process filters/dasher.c:9445
#1 0x7f2fc4119440 in gf_filter_process_task filter_core/filter.c:3208
#2 0x7f2fc40ed45e in gf_fs_thread_proc filter_core/filter_session.c:2393
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/53/53_dasher_process_filters_dasher_c_9445
References:
https://github.com/gpac/gpac/issues/3314
https://nvd.nist.gov/vuln/detail/CVE-2025-60486
https://www.cve.org/CVERecord?id=CVE-2025-60486
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
