CVE-2025-55647 Overview
CVE-2025-55647 is an out-of-memory denial of service vulnerability in GPAC MP4Box version 2.4. The flaw resides in the mp4_mux_cenc_insert_pssh function located in filters/mux_isom.c. An attacker can trigger excessive memory allocation by supplying a crafted MP4 file to the multimedia framework. The condition is classified under [CWE-190] (Integer Overflow or Wraparound), which leads to uncontrolled memory consumption during MP4 muxing operations. Exploitation requires local access and user interaction to process the malicious file. Successful exploitation crashes the GPAC process, disrupting media processing workflows that rely on the library.
Critical Impact
A crafted MP4 file causes the GPAC MP4Box process to exhaust available memory, resulting in a denial of service on the local system.
Affected Products
- GPAC MP4Box v2.4
- GPAC multimedia framework (gpac:gpac)
- Applications and pipelines bundling vulnerable GPAC builds
Discovery Timeline
- 2026-06-15 - CVE-2025-55647 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55647
Vulnerability Analysis
The vulnerability affects GPAC's ISO Base Media File Format muxer, specifically the Common Encryption (CENC) Protection System Specific Header (PSSH) insertion logic. When MP4Box parses a crafted MP4 input, the mp4_mux_cenc_insert_pssh function computes allocation sizes based on attacker-controlled fields without sufficient bounds validation. The resulting integer overflow or wraparound produces an oversized allocation request that exhausts process memory. The process aborts before completing the mux operation, terminating any downstream media processing.
The attack requires local access because MP4Box is typically invoked through a command-line interface or library binding on the victim host. User interaction is required because a user or automated workflow must feed the crafted MP4 file into MP4Box. Confidentiality and integrity remain unaffected, but availability is fully compromised for the muxing operation.
Root Cause
The root cause is improper validation of arithmetic operations during PSSH box construction in filters/mux_isom.c. The function trusts size fields embedded in the input MP4 when calculating buffer requirements for protection system data. Maliciously large or wrapped values cause the allocator to either request unsatisfiable amounts of memory or compute incorrect bounds, both producing an out-of-memory condition.
Attack Vector
An attacker delivers a crafted MP4 file to a target that processes media through GPAC MP4Box. Common scenarios include build pipelines, video transcoding services running MP4Box locally, and desktop workflows where users open untrusted media files. When MP4Box reaches the CENC PSSH insertion path, the malformed sizing values trigger the out-of-memory abort. No authentication is required, but local execution of MP4Box against the file is necessary. Refer to the OpenWall mailing list discussion for additional technical context.
Detection Methods for CVE-2025-55647
Indicators of Compromise
- Unexpected termination of MP4Box or GPAC-based services with allocation failure messages in process logs.
- Sudden memory pressure events or OOM killer activity on hosts that process MP4 inputs from untrusted sources.
- MP4 inputs containing abnormally large or malformed CENC pssh box length fields.
Detection Strategies
- Monitor process exit codes and crash telemetry for MP4Box invocations across media processing hosts.
- Inspect MP4 inputs with a sanitizing parser prior to handing them to GPAC, flagging files with malformed pssh boxes.
- Correlate file ingestion events with subsequent OOM kernel log entries to identify malicious media artifacts.
Monitoring Recommendations
- Enable resource limits (ulimit -v, cgroup memory caps) on MP4Box workers and alert on limit breaches.
- Log full command lines, input file hashes, and exit status for every MP4Box invocation in batch pipelines.
- Track upstream advisories on the GPAC project channels for patched releases.
How to Mitigate CVE-2025-55647
Immediate Actions Required
- Restrict MP4Box execution to trusted media inputs and isolate processing in sandboxed environments with strict memory limits.
- Disable or avoid CENC-related mux operations on untrusted files until a fixed release is deployed.
- Inventory all systems and container images that ship GPAC v2.4 and prioritize remediation for internet-exposed pipelines.
Patch Information
No official patch is referenced in the NVD entry at the time of publication. Monitor the GPAC upstream advisory channel and the OpenWall oss-security thread for fix availability. Rebuild dependent applications once a patched GPAC release is published.
Workarounds
- Run MP4Box under cgroup or container memory limits so an OOM condition contains itself to a single worker.
- Pre-validate MP4 files with an independent parser and reject inputs with malformed or oversized pssh boxes.
- Remove MP4Box from automated workflows that accept user-supplied media until the issue is resolved upstream.
# Constrain MP4Box memory consumption with systemd-run
systemd-run --scope -p MemoryMax=512M -p MemorySwapMax=0 \
MP4Box -info /path/to/untrusted.mp4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
