CVE-2025-55639: GPAC MP4Box DoS Vulnerability

CVE-2025-55639 Overview

CVE-2025-55639 is a NULL pointer dereference vulnerability [CWE-476] in GPAC MP4Box v2.4. The flaw resides in the gf_isom_add_track_kind() function located in isomedia/isom_write.c. Attackers can trigger the condition by supplying a crafted MP4 file to the multimedia framework. Successful exploitation causes the process to crash, producing a Denial of Service (DoS) condition. The issue is tracked publicly through the GPAC project on GitHub and has an associated proof-of-concept MP4 file.

Critical Impact
A crafted MP4 file processed by MP4Box v2.4 dereferences a NULL schemeURI pointer in gf_isom_add_track_kind(), causing the application to terminate and disrupting media processing pipelines.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework builds incorporating the vulnerable isom_write.c source prior to commit 027ce139
Downstream applications and services that embed the affected GPAC ISO Base Media File Format (ISOBMFF) writer

Discovery Timeline

2026-06-23 - CVE-2025-55639 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in the NVD database

Technical Details for CVE-2025-55639

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in the ISO Base Media File Format (ISOBMFF) writer code of GPAC MP4Box. The function gf_isom_add_track_kind() constructs a GF_KindBox structure and calls gf_strdup(schemeURI) on the input argument without validating that schemeURI is non-NULL. When the function is invoked with a NULL schemeURI, gf_strdup dereferences the pointer and the process aborts.

The attack surface is reachable through the MP4Box command-line utility and any application linking the libgpac library that processes untrusted MP4 input. Because user interaction is required to open or feed the file, the impact is bounded to availability loss of the parsing process rather than code execution.

Root Cause

The root cause is missing input validation on the schemeURI parameter before invoking gf_strdup(). The upstream patch introduces a null guard so that the duplication only occurs when schemeURI is non-NULL, matching the pattern already used for the value parameter on the next line.

Attack Vector

An attacker delivers a crafted MP4 file to a victim or to a service that automatically processes MP4 input with MP4Box. When the file is parsed, the track kind handling path is reached with a NULL schemeURI, the dereference occurs, and the process crashes. A public proof-of-concept MP4 file is available in the sigdevel/pocs repository.

// Patch: src/isomedia/isom_write.c - gf_isom_add_track_kind()
// Source: https://github.com/gpac/gpac/commit/027ce139dda498ee95df36db9f9f6f3cadce8ec9
 	ptr = (GF_KindBox *)gf_isom_box_new(GF_ISOM_BOX_TYPE_KIND);
 	if (e) return e;
 
-	ptr->schemeURI = gf_strdup(schemeURI);
+	if (schemeURI) ptr->schemeURI = gf_strdup(schemeURI);
 	if (value) ptr->value = gf_strdup(value);
 	return udta_on_child_box_ex((GF_Box *)udta, (GF_Box *) ptr, GF_FALSE, GF_FALSE);
 }

The fix adds a if (schemeURI) null guard before calling gf_strdup(). See the GPAC commit 027ce139 and the related issue #3260 for upstream discussion.

Detection Methods for CVE-2025-55639

Indicators of Compromise

Repeated MP4Box or gpac process terminations with SIGSEGV exit signals on hosts that ingest user-supplied MP4 files.
Crash dumps showing the faulting instruction inside gf_strdup called from gf_isom_add_track_kind in isom_write.c.
MP4 files matching the public proof-of-concept hash from the sigdevel/pocs MP4 sample.

Detection Strategies

Monitor for abnormal exit codes from media processing jobs that invoke MP4Box or any binary linked against libgpac.
Inspect MP4 atoms during ingest and flag kind boxes that omit the schemeURI field, as this is the condition that reaches the vulnerable code path.
Correlate crash telemetry with file uploads to identify malicious sample delivery to transcoding or thumbnailing services.

Monitoring Recommendations

Enable core dump collection for media worker processes so that crashes in gf_isom_add_track_kind can be triaged quickly.
Track the version of GPAC deployed across build images and container registries to confirm that patched binaries replace v2.4.
Alert on repeated failures of the same upstream file across multiple processing workers, which suggests a malformed input rather than infrastructure issues.

How to Mitigate CVE-2025-55639

Immediate Actions Required

Upgrade GPAC to a build that includes commit 027ce139dda498ee95df36db9f9f6f3cadce8ec9 or later.
Rebuild and redeploy any container images, packages, or applications that statically or dynamically link libgpac versions at or below v2.4.
Restrict MP4 ingestion endpoints to authenticated users where business requirements allow, reducing exposure to anonymous DoS attempts.

Patch Information

The upstream fix is available in the GPAC GitHub repository as commit 027ce139, which addresses issue #3260. The patch adds a null check on the schemeURI argument inside gf_isom_add_track_kind() in src/isomedia/isom_write.c. Distributions and downstream consumers should rebuild against a source tree that contains this commit.

Workarounds

Run MP4Box and other GPAC tools inside a sandbox or container with automatic restart so that a crash does not interrupt the broader service.
Pre-validate MP4 files with a separate parser and reject samples whose kind box lacks a schemeURI value before passing them to GPAC.
Limit the CPU, memory, and time budget for each MP4Box invocation so that repeated crashes cannot exhaust worker capacity.

bash

# Build GPAC from a source tree containing the fix
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 027ce139dda498ee95df36db9f9f6f3cadce8ec9
./configure --static-bin
make -j$(nproc)
sudo make install
MP4Box -version