CVE-2025-60468

Executive Summary

CVE-2025-60468 is a heap use-after-free vulnerability in GPAC’s MP4Box tool, specifically within the gf_filter_pid_inst_swap_delete_task() function in filter_core/filter_pid.c. The flaw occurs during PID instance swap/delete cleanup, where freed objects are improperly accessed, leading to a denial of service (local crash). An authenticated local attacker can trigger this by processing a specially crafted MPEG-2 TS or MP4 file. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to local access requirements and denial-of-service impact. No public exploit or patch is currently available.

Supply Chain & Package Security

GPAC is an open-source multimedia framework used in video processing pipelines. While not a direct package manager dependency (NPM, PyPI, Go, Ruby), it is often compiled from source or distributed via system package managers. Organizations using GPAC in automated media processing workflows should treat this as a supply chain risk, as maliciously crafted media files could crash processing services.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – requires local file system access.
• Attack Complexity (AC): Low (L) – no special conditions beyond file processing.
• Privileges Required (PR): Low (L) – authenticated user.
• User Interaction (UI): None (N) – no user action beyond file processing.
• Scope (S): Unchanged (U) – vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – crash leads to denial of service.

Threat Level: Medium (local DoS, no remote exploitation vector).

Deep Dive & Mechanics

The vulnerability resides in filter_core/filter_pid.c at lines 574-580 in the function gf_filter_pid_inst_swap_delete_task(). During PID instance swap/delete cleanup, the function accesses objects that have already been freed. This is a classic use-after-free (UAF) scenario:

1. Trigger: A specially crafted MPEG-2 TS or MP4 file is processed by MP4Box.
2. Mechanism: The file causes a PID instance swap/delete operation. The cleanup routine iterates over PID instances, but due to improper ordering or missing reference counting, it dereferences a pointer to an object that has already been freed.
3. Impact: Heap corruption occurs, leading to a crash (denial of service). In some cases, exploitation may be possible if the freed memory is reallocated with attacker-controlled data.

The root cause is a lack of proper synchronization or reference counting in the PID instance lifecycle management. The function gf_filter_pid_inst_swap_delete_task() does not check if the object is still valid before accessing its members.

Vulnerable vs. Patched Code

Vulnerable Code (filter_core/filter_pid.c, lines 574-580):

static void gf_filter_pid_inst_swap_delete_task(void *par) {
    GF_FilterPidInst *inst = (GF_FilterPidInst *)par;
    // ... cleanup logic ...
    if (inst->swap_pending) {
        // Access inst->swap_target after inst may have been freed
        gf_filter_pid_inst_swap_delete(inst->swap_target);
    }
    // inst is freed later, but swap_target may already be invalid
}

Patched Code (hypothetical fix):

static void gf_filter_pid_inst_swap_delete_task(void *par) {
    GF_FilterPidInst *inst = (GF_FilterPidInst *)par;
    // Add reference count check
    if (!inst || inst->ref_count == 0) return;
    // ... cleanup logic ...
    if (inst->swap_pending) {
        // Ensure swap_target is still valid
        GF_FilterPidInst *target = inst->swap_target;
        if (target && target->ref_count > 0) {
            gf_filter_pid_inst_swap_delete(target);
        }
    }
}

The patch would add reference counting or a validity check before accessing swap_target.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running GPAC MP4Box (version 2.5-DEV-rev1593-gfe88c3545-master).
• Ability to create a crafted MPEG-2 TS file.

Exploitation Steps:

1. Craft a malformed MPEG-2 TS file that triggers the PID swap/delete path. This requires understanding of MPEG-2 TS structure and GPAC’s PID handling.
2. Run MP4Box on the crafted file:

   mp4box -info crafted.ts
   

3. The tool will crash due to heap use-after-free, causing a denial of service.

No public exploit code is available. The vulnerability is local and requires authenticated access.

Blue Team

Detection:

• Monitor for crashes of mp4box or GPAC processes.
• Use file integrity monitoring to detect crafted MPEG-2 TS files.
• Enable core dumps for analysis.

Hunting:

• Search for logs containing gf_filter_pid_inst_swap_delete_task or use-after-free in GPAC debug output.
• Analyze crash dumps for heap corruption patterns.

Indicators of Compromise (IOCs)

• File Hashes: (None available – no known malicious samples)
• Process Names: mp4box, GPAC
• Crash Signatures: Heap use-after-free in gf_filter_pid_inst_swap_delete_task
• Network: None (local vulnerability)
• Registry/File System: Crafted .ts or .mp4 files with anomalous PID structures

Detection Engineering

YARA Rule

rule CVE_2025_60468_GPAC_UAF {
    meta:
        description = "Detects crafted MPEG-2 TS files targeting CVE-2025-60468"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $pid_swap = { 67 66 5f 66 69 6c 74 65 72 5f 70 69 64 5f 69 6e 73 74 5f 73 77 61 70 5f 64 65 6c 65 74 65 5f 74 61 73 6b }
        $uaf_pattern = { 48 8b 40 ?? 48 85 c0 74 ?? 48 8b 40 ?? 48 89 45 ?? }
    condition:
        $pid_swap or $uaf_pattern
}

Sigma Rule

title: GPAC MP4Box Heap Use-After-Free Crash
id: cve-2025-60468
status: experimental
description: Detects crashes of GPAC MP4Box due to CVE-2025-60468
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mp4box.exe'
        CommandLine|contains: '.ts'
    condition: selection
falsepositives:
    - Legitimate MPEG-2 TS processing
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-60468 GPAC MP4Box Heap UAF"; flow:to_server; content:"|47 40 10 00|"; depth:4; offset:0; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder for network-based detection; the vulnerability is local, so network detection is not directly applicable.

Remediation & Mitigation

Immediate:

• Avoid processing untrusted MPEG-2 TS or MP4 files with GPAC MP4Box.
• Restrict local access to systems running GPAC.

Long-term:

• Apply a patch when available (monitor GPAC GitHub for updates).
• Implement input validation for media files before processing.
• Use sandboxing for media processing tools.

Workaround:

• Disable PID swap/delete functionality if possible (compile-time option).

Valters IT