CVE-2025-55649: GPAC MP4Box NULL Pointer DoS Vulnerability

CVE-2025-55649 Overview

CVE-2025-55649 is a NULL pointer dereference vulnerability in GPAC MP4Box v2.4. The flaw resides in the gf_media_map_esd function within media_tools/isom_tools.c. Attackers can trigger the vulnerability by supplying a crafted MP4 file to the parser. Successful exploitation causes the MP4Box process to crash, resulting in a Denial of Service (DoS) condition.

GPAC is an open-source multimedia framework widely used for processing MP4, MPEG-DASH, and other container formats. MP4Box is the command-line packaging utility provided by GPAC. The issue is tracked under [CWE-476: NULL Pointer Dereference].

Critical Impact
A crafted MP4 file processed by MP4Box v2.4 causes gf_media_map_esd to dereference a NULL pointer, terminating the process and disrupting media workflows that depend on GPAC tooling.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (gpac:gpac)
Downstream applications and pipelines that invoke MP4Box for MP4 processing

Discovery Timeline

2026-06-15 - CVE-2025-55649 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55649

Vulnerability Analysis

The vulnerability resides in gf_media_map_esd, a function in media_tools/isom_tools.c that maps Elementary Stream Descriptors (ESD) when processing ISO Base Media File Format (MP4) input. When MP4Box parses a malformed or specially crafted MP4 file, the function operates on a pointer that has not been initialized or validated. Dereferencing this NULL pointer terminates the process.

The issue requires local access and user interaction, meaning the victim must invoke MP4Box against the attacker-supplied file. There is no impact to confidentiality or integrity, but availability is fully compromised for the running process. Automated build pipelines, transcoding farms, or CI systems that process untrusted MP4 inputs may experience repeated crashes.

The EPSS score is 0.188%, indicating low observed exploitation probability. No public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is missing pointer validation inside gf_media_map_esd before the function accesses ESD-related structures. Crafted MP4 atoms can lead the parser into a code path where an expected descriptor object is never allocated or is returned as NULL. The function then dereferences this pointer, causing a segmentation fault.

Attack Vector

The attacker crafts an MP4 file containing malformed elementary stream descriptors or atom structures. The attacker delivers the file to a target system via email, file share, web download, or any local delivery channel. The victim runs MP4Box against the file, either directly or through an automated workflow. MP4Box loads the file, reaches gf_media_map_esd, dereferences the NULL pointer, and crashes.

The vulnerability cannot be triggered remotely without local execution of MP4Box on the malicious file. Refer to the Openwall OSS Security Alert for additional technical context.

Detection Methods for CVE-2025-55649

Indicators of Compromise

Unexpected crashes or segmentation faults from the MP4Box binary when processing MP4 inputs
Core dump files generated by MP4Box referencing gf_media_map_esd in media_tools/isom_tools.c
MP4 files from untrusted sources containing malformed or truncated elementary stream descriptors

Detection Strategies

Monitor process exit codes and signal terminations (SIGSEGV) for MP4Box across media-processing hosts
Inspect MP4 inputs with a sandboxed parser before feeding them to production GPAC pipelines
Enable core dump collection and analyze stack traces for references to gf_media_map_esd

Monitoring Recommendations

Track GPAC version inventory across endpoints and servers to flag installations running v2.4 or earlier
Log all MP4Box invocations along with input file paths and source attribution
Alert on repeated MP4Box crashes within short time windows, which may indicate automated abuse

How to Mitigate CVE-2025-55649

Immediate Actions Required

Identify all hosts running GPAC MP4Box v2.4 and restrict access to untrusted MP4 inputs
Update GPAC to a fixed version once released by the maintainers; track the upstream GPAC project advisories
Run MP4Box under a non-privileged service account inside a sandbox or container to limit blast radius

Patch Information

No official patch identifier was listed in the NVD record at the time of publication. Monitor the GPAC project repository and the Openwall OSS Security Alert for fix commits addressing the NULL pointer dereference in gf_media_map_esd. Apply updates as soon as a corrected release becomes available.

Workarounds

Validate MP4 inputs with a hardened pre-parser or schema check before invoking MP4Box
Execute MP4Box inside a restricted container with resource limits and automatic restart on failure
Block or quarantine MP4 files originating from untrusted senders at the email or web gateway
Disable MP4Box automation on shared workstations until a patched version is deployed

bash

# Configuration example: run MP4Box in a restricted systemd-run sandbox
systemd-run --uid=mp4box --gid=mp4box \
  --property=NoNewPrivileges=yes \
  --property=ProtectSystem=strict \
  --property=PrivateTmp=yes \
  --property=MemoryMax=512M \
  --property=Restart=on-failure \
  /usr/bin/MP4Box -info /sandbox/input.mp4