CVE-2025-60467

FAUCET Score

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

First published: Jun 24, 2026Last modified: Jun 24, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 26.02.0CPE matchmatch criteria	cpe:2.3:a:gpac:gpac::::::::

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.55%

Probability of exploitation in next 30 days

EPSS Percentile

43.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0055 is in the 20th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

github_advisorypatch availablevia nvd_reference

View patch

References

openwall.com / lists/oss-security/2026/06/27/4

ExploitMailing ListThird Party Advisory

github.com / gpac/gpac/commit/976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77

Patch

github.com / gpac/gpac/issues/3286

ExploitIssue Tracking

github.com / sigdevel/pocs/blob/main/res/gpac/MP4Box/37/37_gf_filter_pid_inst_swap_delete_task_filter_core_filter_pid_c_574

Exploit

github.com / sigdevel/pocs/blob/main/res/gpac/MP4Box/37/README.md

Exploit

infosec.exchange / @sigdevel/116780518074911144

ExploitPatchThird Party Advisory