{"id":"CVE-2025-60487","details":"A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.","modified":"2026-10-22T16:08:08.408671156Z","published":"2026-10-21T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60487.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"4Box"},{"fixed":"2.5"}],"source":"DESCRIPTION"}]}],"cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60487.json"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3320"},{"type":"WEB","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/56/README.md"},{"type":"WEB","url":"https://infosec.exchange/@sigdevel/117456633862790827"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60487"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"e6d01820d7bf3967d931fedb379ee5f209bc133b"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"e6d01820d7bf3967d931fedb379ee5f209bc133b"}]}]}}],"versions":["abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-60487.json","vanir_signatures":[{"id":"CVE-2025-60487-3b557214","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"function":"dasher_configure_pid","file":"src/filters/dasher.c"},"deprecated":false,"digest":{"function_hash":"199193566362182277671567014971897598992","length":27175}},{"digest":{"line_hashes":["18932393730742255432453235775156873288","270764964189030152645070470071380676127","203278179028737446463915301054632003726","26470146062633646409700590501854041123"],"threshold":0.9},"id":"CVE-2025-60487-44068655","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"applications/mp4box/filedump.c"},"deprecated":false},{"digest":{"line_hashes":["317538733772543257714868350721726851573","137681394362777990054220572964002058179","142975858742031049477880172076800051828","203598634951213534465747330965941789001","163716403421700846906667530234405621781","317986557153736425087238008084793996035","238519764834600678469054849651481763603","93227704173811863791141511083492932459","88791466694522139178564174306992216343","103019590927704249470899543114139376321","77841915592605315089333655969047531240","154038803093701615408291907311435998544","262975630474639848023276571725028318126","280175335559217037197328790295620441384","29261712364992840501577639974975309736","198518410689237081419018262826185960088","261003641882765732018676017977844923181","102945830147294261733650850005714985781","70196362472973435179664887836685463438","98136200847790978478183906301048952944","148220903167292014333896411881072894254","112743802115215259457116489040444028229","314290810626926821994804814259417773724","106407875581277610765102174148391597028","22108762012841155499484521830349600840","7179292035962996126116823087877580176","327611018766656538872449455059416753972","130656830246720395881826214564943429671","54622022950901821246888125045551280937","225295717380783183469772857211377099329","293423430594466348730012397236555846876","42302748561924312812961428263952810263","198699169140994778824602578411698069490","176949747484912305936256339836182072158"],"threshold":0.9},"id":"CVE-2025-60487-9537c0f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/filters/dasher.c"},"deprecated":false},{"id":"CVE-2025-60487-a29bd9f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"applications/mp4box/filedump.c","function":"dump_isom_saps"},"deprecated":false,"digest":{"function_hash":"72938795741503737622083433653794534487","length":2028}},{"id":"CVE-2025-60487-a5d38257","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/isomedia/isom_read.c"},"deprecated":false,"digest":{"line_hashes":["242170403633445511533484490383533956107","123559476618757254484850121810495946772","274232141822084879926864990161210122112","144407673426189294790732282237281067418"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["123651366942589291184106866356819776233","309068702292035141079474280135500620950","146885122247678406655456477415361815509","206138803660333225707896228933792087808"]},"id":"CVE-2025-60487-a788a807","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"312013340158895046591627719361534586937","length":319},"id":"CVE-2025-60487-b16f5372","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/isomedia/isom_read.c","function":"gf_isom_get_esd"}},{"target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c","function":"TraverseIFS2D"},"deprecated":false,"digest":{"function_hash":"14270339333290916441435841127438430668","length":1509},"id":"CVE-2025-60487-c80451ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b"}],"vanir_signatures_modified":"2026-10-22T16:08:08Z"}}],"schema_version":"1.9.2"}