CVE-2025-55645 Overview
CVE-2025-55645 is a heap buffer overflow vulnerability in the gf_cenc_set_pssh function located in isomedia/drm_sample.c of GPAC MP4Box v2.4. The flaw allows local attackers to trigger a Denial of Service (DoS) condition by supplying a crafted MP4 file to the multimedia framework. GPAC is a widely deployed open-source multimedia framework used for packaging, streaming, and processing MPEG-4 and related media formats. The vulnerability falls under [CWE-122: Heap-based Buffer Overflow] and requires user interaction to exploit.
Critical Impact
A locally crafted MP4 file processed by MP4Box v2.4 corrupts heap memory in the Common Encryption (CENC) sample handling logic, causing the application to crash and resulting in a Denial of Service.
Affected Products
- GPAC MP4Box version 2.4
- GPAC multimedia framework (gpac:gpac)
- Applications and pipelines that embed GPAC libraries for MP4 processing
Discovery Timeline
- 2026-06-15 - CVE-2025-55645 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55645
Vulnerability Analysis
The vulnerability resides in the gf_cenc_set_pssh function within isomedia/drm_sample.c. This function handles Protection System Specific Header (PSSH) boxes used in the Common Encryption (CENC) scheme for DRM-protected MP4 media. When MP4Box parses a malformed PSSH structure inside a crafted MP4 container, the function writes beyond the bounds of a heap-allocated buffer.
The out-of-bounds write corrupts adjacent heap metadata or data structures, triggering memory corruption that the allocator detects or that causes immediate process termination. Because the issue is reached during normal MP4 parsing, any workflow that ingests untrusted MP4 files into MP4Box is exposed. The attack vector is local and requires the victim to open or process the malicious file, but no privileges are required from the attacker.
Root Cause
The root cause is insufficient bounds validation on length fields or sizes derived from attacker-controlled MP4 metadata before they are used to copy or initialize PSSH data into a heap buffer. The function trusts size values parsed from the file without verifying them against the actual allocation size, producing the classic [CWE-122] heap-based buffer overflow pattern.
Attack Vector
An attacker crafts an MP4 file containing a malformed pssh box with manipulated size or count fields. The file is delivered to a target through email, download, shared storage, or a media processing pipeline. When the victim runs MP4Box against the file, parsing reaches gf_cenc_set_pssh, the heap is corrupted, and the process crashes. The current CVSS profile indicates no confidentiality or integrity impact, but availability is high — limiting the practical outcome to Denial of Service.
No public exploit code or proof of concept has been published. Refer to the OpenWall OSS Security Discussion and the InfoSec Exchange Post for additional technical context.
Detection Methods for CVE-2025-55645
Indicators of Compromise
- Unexpected crashes or SIGABRT / SIGSEGV terminations of MP4Box or processes linking the GPAC libraries.
- Heap corruption messages from glibc (for example, malloc(): corrupted or free(): invalid pointer) in system or application logs.
- Inbound MP4 files with anomalous or oversized pssh boxes referenced in media processing audit logs.
Detection Strategies
- Run MP4Box under AddressSanitizer (ASan) in test environments to surface heap overflows when processing suspect files.
- Hash and inventory the GPAC binaries deployed across endpoints and build servers, then compare against the vulnerable v2.4 release.
- Monitor automated media ingestion pipelines for repeated parser crashes correlated with specific input files.
Monitoring Recommendations
- Forward crash telemetry from systems running MP4Box to a centralized logging or SIEM platform for correlation.
- Alert on repeated abnormal terminations of media processing services, which may indicate active exploitation attempts.
- Track newly introduced MP4 files in shared storage and sandbox-parse them before downstream automated workflows touch them.
How to Mitigate CVE-2025-55645
Immediate Actions Required
- Inventory all systems and containers running GPAC MP4Box v2.4 and identify any pipelines that process untrusted MP4 input.
- Restrict MP4Box execution to trusted, validated media sources until a fixed upstream release is applied.
- Isolate media transcoding workloads in sandboxed or containerized environments with restrictive resource limits to contain crashes.
Patch Information
No official fixed version has been listed in the NVD entry at publication time. Track the GPAC project repository and the OpenWall OSS Security Discussion for patch availability. Once a patched release is published, upgrade all MP4Box installations and rebuild any applications that statically link GPAC libraries.
Workarounds
- Avoid invoking MP4Box on MP4 files originating from untrusted sources, especially files containing DRM/CENC pssh boxes.
- Pre-validate incoming MP4 files with a hardened parser or schema check that rejects malformed pssh structures before they reach MP4Box.
- Run MP4Box as a low-privilege, non-interactive service account with automatic restart so a DoS crash does not halt the broader pipeline.
- Apply OS-level exploit mitigations such as hardened malloc and process resource limits to reduce blast radius on shared hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
