CVE-2025-55644 Overview
CVE-2025-55644 is a heap use-after-free vulnerability in the gf_node_get_tag function within scenegraph/base_scenegraph.c of GPAC MP4Box v2.4. An attacker can trigger the flaw by supplying a crafted MP4 file to a vulnerable installation. Successful exploitation results in a denial-of-service condition affecting the local process. The vulnerability is tracked under CWE-416: Use After Free and requires user interaction to open or process the malicious file.
Critical Impact
Processing a crafted MP4 file with a vulnerable GPAC MP4Box build causes a heap use-after-free that crashes the application, resulting in denial of service for media processing workflows.
Affected Products
- GPAC MP4Box version 2.4
- GPAC multimedia framework builds incorporating the vulnerable base_scenegraph.c
- Applications and pipelines that bundle the affected GPAC library
Discovery Timeline
- 2026-06-15 - CVE-2025-55644 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55644
Vulnerability Analysis
The vulnerability resides in gf_node_get_tag, a scenegraph helper function in GPAC's scenegraph/base_scenegraph.c. The function dereferences a heap-allocated node object after it has already been freed during MP4 parsing. When MP4Box processes a malformed scenegraph structure in a crafted MP4 file, control flow reaches gf_node_get_tag with a dangling pointer. Reading the node tag from freed memory corrupts internal state and aborts the process.
The attack requires local access because MP4Box is a command-line tool typically invoked against files on disk. Confidentiality and integrity are not affected, but availability is impacted because the process terminates. Automated media processing services that call MP4Box on untrusted uploads inherit this exposure and may fail repeatedly when fed adversarial input.
Root Cause
The root cause is improper lifetime management of scenegraph node objects [CWE-416]. The code path freeing a node does not clear or invalidate pointers held elsewhere in the scenegraph structures. Subsequent calls to gf_node_get_tag operate on the stale pointer, producing a classic use-after-free. The bug is deterministic given a crafted input that triggers the specific free-then-reuse sequence.
Attack Vector
An attacker crafts an MP4 file with malformed scene description data. The victim, or an automated service, runs MP4Box against the file. During parsing, the scenegraph manipulation logic frees a node and later invokes gf_node_get_tag on the same address, triggering the use-after-free and a process crash. No network access, authentication, or elevated privileges are required, but the victim must initiate the file processing operation.
No public proof-of-concept exploit is listed in the references. Technical discussion is available in the OpenWall OSS Security Post and the InfoSec Exchange Thread.
Detection Methods for CVE-2025-55644
Indicators of Compromise
- Repeated crashes of MP4Box or applications linking GPAC libraries when processing user-supplied MP4 files.
- Core dumps or AddressSanitizer reports referencing gf_node_get_tag in scenegraph/base_scenegraph.c.
- MP4 files with anomalous or malformed scene description (BIFS/LASeR) sections submitted to media processing pipelines.
Detection Strategies
- Run MP4Box under memory sanitizers such as AddressSanitizer in test environments to surface use-after-free conditions on suspicious inputs.
- Monitor process exit codes and signal terminations (SIGSEGV, SIGABRT) from media transcoding workers handling untrusted files.
- Inspect ingested MP4 files for unusual scenegraph atoms before passing them to GPAC-based tooling.
Monitoring Recommendations
- Alert on abnormal termination rates for GPAC-based services and correlate with the originating file hash and submitter.
- Retain crashed input samples in quarantine storage for offline analysis and regression testing against patched builds.
- Track the GPAC version deployed across hosts and container images to identify systems still running version 2.4 or earlier vulnerable builds.
How to Mitigate CVE-2025-55644
Immediate Actions Required
- Inventory all systems, containers, and pipelines that use GPAC MP4Box, including third-party tools that embed the library.
- Restrict MP4Box invocation to trusted inputs and isolate processing of user-submitted media in sandboxed or ephemeral environments.
- Subscribe to the GPAC project repository for upstream fixes addressing gf_node_get_tag in base_scenegraph.c.
Patch Information
No fixed version is listed in the NVD entry at publication. Monitor the upstream GPAC project for a commit addressing the use-after-free in gf_node_get_tag and rebuild or upgrade affected packages once available. Review the OpenWall OSS Security Post for status updates from maintainers.
Workarounds
- Avoid processing untrusted MP4 files with GPAC MP4Box v2.4 until a patched release is deployed.
- Run MP4Box inside a restricted sandbox (containers with no network, seccomp filters, or firejail) so crashes do not affect host services.
- Pre-filter incoming MP4 files using a separate validator that rejects malformed scenegraph structures before invoking MP4Box.
# Configuration example: sandbox MP4Box execution with resource limits
firejail --quiet --net=none --private-tmp --rlimit-as=536870912 \
MP4Box -info /input/untrusted.mp4 || echo "MP4Box failed on input"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
