CVE-2025-55641: GPAC MP4Box DoS Vulnerability

CVE-2025-55641 Overview

CVE-2025-55641 is a NULL pointer dereference vulnerability in GPAC MP4Box version 2.4. The flaw resides in the gf_isom_copy_sample_info function within isomedia/isom_write.c. An attacker can trigger the dereference by supplying a crafted MP4 file to the parser. Successful exploitation causes the application to crash, resulting in a Denial of Service (DoS) condition. The vulnerability is classified under [CWE-476] and requires local access with user interaction. GPAC is a widely used open-source multimedia framework, and MP4Box is its command-line packaging utility commonly integrated into media processing pipelines.

Critical Impact
A crafted MP4 file processed by GPAC MP4Box v2.4 causes a NULL pointer dereference in gf_isom_copy_sample_info, terminating the process and disrupting media workflows that depend on it.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (gpac:gpac)
Applications and pipelines embedding the affected GPAC isomedia library

Discovery Timeline

2026-06-15 - CVE-2025-55641 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55641

Vulnerability Analysis

The vulnerability exists in gf_isom_copy_sample_info, a routine in isomedia/isom_write.c responsible for copying sample metadata between ISO Base Media File Format (ISOBMFF) structures. When MP4Box parses a malformed MP4 container, the function operates on a pointer that has not been initialized or validated. Dereferencing this NULL pointer causes an immediate process crash.

Exploitation requires a user to invoke MP4Box on a crafted MP4 file. The attacker does not need authentication or network access. The impact is limited to availability, with no compromise to confidentiality or integrity.

Automated media processing systems that ingest untrusted MP4 input are most affected. A single malformed file can terminate batch jobs, transcoding services, or streaming preparation tasks. The EPSS score of 0.188% indicates a low predicted likelihood of active exploitation.

Root Cause

The root cause is missing pointer validation prior to dereference inside gf_isom_copy_sample_info. The function assumes the sample information structure passed in is non-NULL, but specific malformed ISOBMFF box sequences cause earlier parsing logic to return NULL without aborting the copy operation. The code path then accesses a member of that NULL structure, triggering a segmentation fault.

Attack Vector

An attacker crafts an MP4 file containing malformed sample table or track box structures. The attacker delivers the file through any channel the victim trusts, such as email, file share, or web download. When the victim processes the file with MP4Box, parsing reaches gf_isom_copy_sample_info and the dereference occurs. The MP4Box process exits immediately, halting any downstream task. In server-side automation contexts, the crash can cascade into job failures and pipeline outages.

No verified proof-of-concept code is published. The vulnerability mechanism is described in the OpenWall OSS-Security Message and the InfoSec Exchange Post.

Detection Methods for CVE-2025-55641

Indicators of Compromise

Unexpected termination of MP4Box processes with segmentation fault exit codes (SIGSEGV / exit 139 on Linux)
Core dumps referencing gf_isom_copy_sample_info in the call stack
Repeated failures in media transcoding or packaging jobs immediately after ingesting new MP4 inputs
Presence of MP4 files with malformed moov, trak, or stbl box structures in ingestion directories

Detection Strategies

Monitor process exit codes and crash logs for MP4Box and any application linking the GPAC libgpac library.
Inspect application logs for parser errors immediately preceding process termination during MP4 handling.
Validate MP4 inputs with a separate sanity-check tool before passing files to MP4Box in automated pipelines.
Track the installed GPAC version against the fixed release once published by the vendor.

Monitoring Recommendations

Forward host crash telemetry, including dmesg segfault records and systemd-coredump events, to a central log platform.
Alert on repeated MP4Box crashes originating from the same source directory or upload account.
Audit file upload endpoints that feed MP4 content into GPAC-based workflows for anomalous submissions.

How to Mitigate CVE-2025-55641

Immediate Actions Required

Inventory all systems running GPAC MP4Box v2.4 and any application bundling the GPAC isomedia library.
Restrict MP4Box execution to trusted MP4 inputs and isolate the process in a sandbox or container with resource limits.
Disable or pause automated pipelines that process untrusted MP4 uploads with MP4Box until a patched build is deployed.
Run MP4Box under a non-privileged service account so crashes do not affect other workloads.

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Track upstream commits on the GPAC project and review the OpenWall OSS-Security Message for vendor updates. Apply the patched GPAC release as soon as it becomes available and rebuild any downstream applications that statically link libgpac.

Workarounds

Pre-validate MP4 files with an independent ISOBMFF parser and reject files that fail structural checks before invoking MP4Box.
Wrap MP4Box invocations in a supervisor that catches non-zero exit codes and quarantines the offending input file.
Run MP4Box inside an ephemeral container so a crash does not impact the host or other tenants.
Limit the user accounts permitted to upload or stage MP4 files in shared processing environments.

bash

# Configuration example: sandbox MP4Box and quarantine crash-inducing inputs
#!/bin/bash
INPUT="$1"
QUARANTINE="/var/quarantine/mp4"

timeout 60 firejail --quiet --net=none --private-tmp \
  MP4Box -info "$INPUT"
RC=$?

if [ $RC -ne 0 ]; then
  mkdir -p "$QUARANTINE"
  mv "$INPUT" "$QUARANTINE/"
  logger -t mp4box-guard "Quarantined $INPUT (exit=$RC)"
fi