CVE-2025-55650: GPAC MP4Box Use-After-Free Vulnerability

CVE-2025-55650 Overview

CVE-2025-55650 is a heap use-after-free vulnerability in GPAC MP4Box v2.4. The flaw resides in the gf_node_get_tag function within scenegraph/base_scenegraph.c. Attackers can trigger the vulnerability by supplying a crafted MP4 file, causing a Denial of Service (DoS) condition. The vulnerability is classified under [CWE-416] Use After Free. Exploitation requires local access and user interaction, such as opening or processing the malicious media file with MP4Box. No remote attack vector exists, and no public exploit or in-the-wild exploitation has been reported.

Critical Impact
Processing a crafted MP4 file with GPAC MP4Box v2.4 causes a heap use-after-free condition that crashes the application, resulting in denial of service.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (gpac:gpac)
Applications and toolchains embedding the vulnerable scenegraph/base_scenegraph.c component

Discovery Timeline

2026-06-15 - CVE-2025-55650 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55650

Vulnerability Analysis

The vulnerability stems from improper memory management in GPAC's scene graph handling code. The gf_node_get_tag function in scenegraph/base_scenegraph.c dereferences a heap object after it has been freed. When MP4Box parses a malformed MP4 container, the parser releases a scene graph node while still holding a stale reference to it. Subsequent access through gf_node_get_tag operates on the freed memory region.

This class of bug, [CWE-416] Use After Free, often results in unpredictable program state. In this case the documented outcome is a process crash and denial of service. The crash affects any tool or pipeline that invokes MP4Box to inspect or transcode untrusted media files.

Root Cause

The root cause is a lifetime mismatch between a scene graph node object and a pointer used by gf_node_get_tag. The node is freed during MP4 parsing, but the calling code retains and later uses the dangling pointer. The crafted MP4 input drives the parser into the code path that exercises this stale reference.

Attack Vector

Exploitation requires the victim to process an attacker-supplied MP4 file with a vulnerable MP4Box build. The attack vector is local and requires user interaction. The impact is limited to availability, with no documented confidentiality or integrity compromise. Automated media-processing services that accept user-uploaded MP4 files are at higher risk because they may invoke MP4Box on attacker-controlled input without explicit user action.

No verified public proof-of-concept code is available. Technical discussion is referenced in the OpenWall OSS Security thread and the InfoSec Exchange advisory post.

Detection Methods for CVE-2025-55650

Indicators of Compromise

Repeated crashes or abnormal terminations of the MP4Box process when processing user-supplied MP4 files
Core dumps or crash signatures referencing gf_node_get_tag or base_scenegraph.c
AddressSanitizer or Valgrind reports flagging heap-use-after-free in GPAC binaries during media processing

Detection Strategies

Monitor logs from media-processing services and CI pipelines for unexpected MP4Box exit codes or segmentation faults
Scan endpoints and servers for installed GPAC versions and flag any instance at version 2.4 or earlier
Inspect MP4 files queued for processing for malformed scene graph structures using sandboxed parsers prior to invoking MP4Box

Monitoring Recommendations

Track process termination events for MP4Box and correlate with the input file hash for triage
Forward GPAC crash telemetry and stack traces to a centralized logging or SIEM platform for trend analysis
Alert on abnormal volumes of MP4 file submissions to internal media pipelines, which may indicate a DoS attempt

How to Mitigate CVE-2025-55650

Immediate Actions Required

Inventory all systems running GPAC and identify hosts on MP4Box v2.4 or earlier
Restrict MP4Box execution to trusted input sources until a patched build is deployed
Run MP4Box under sandboxing or resource limits to contain crashes and prevent service-wide impact
Validate MP4 file structure before passing files to MP4Box in automated pipelines

Patch Information

No official fixed version is referenced in the NVD entry at the time of publication. Monitor the GPAC project repository and the OpenWall OSS Security advisory for updates. Once a patched release becomes available, upgrade all GPAC installations to the corrected version.

Workarounds

Disable MP4Box processing of untrusted MP4 files until a fix is applied
Execute MP4Box inside a container or seccomp-restricted sandbox to isolate use-after-free crashes
Apply automatic restart policies for media-processing services so denial of service does not become persistent
Replace MP4Box with an alternative parser for high-risk inputs where feasible

bash

# Configuration example: run MP4Box under systemd with restart and resource limits
[Service]
ExecStart=/usr/bin/MP4Box -info /var/media/input.mp4
Restart=on-failure
RestartSec=5
MemoryMax=512M
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict