CVE-2025-55651: GPAC MP4Box DoS Vulnerability

CVE-2025-55651 Overview

CVE-2025-55651 is a NULL pointer dereference vulnerability in GPAC MP4Box version 2.4. The flaw resides in the gf_isom_get_user_data_count function within isomedia/isom_read.c. An attacker supplies a crafted MP4 file to trigger the dereference, causing the MP4Box process to crash. Successful exploitation results in a Denial of Service (DoS) condition on the host running the multimedia tool.

The vulnerability is tracked under CWE-476: NULL Pointer Dereference. Exploitation requires local access and user interaction, typically through opening or processing a malicious media file.

Critical Impact
A crafted MP4 file processed by GPAC MP4Box v2.4 crashes the application through a NULL pointer dereference, denying availability of the multimedia processing service.

Affected Products

GPAC MP4Box v2.4
GPAC framework isomedia/isom_read.c component
Applications and pipelines embedding the vulnerable gf_isom_get_user_data_count function

Discovery Timeline

2026-06-09 - CVE-2025-55651 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2025-55651

Vulnerability Analysis

The vulnerability exists in the ISO Base Media File Format (ISOBMFF) parsing layer of GPAC, the open-source multimedia framework that powers MP4Box. The function gf_isom_get_user_data_count enumerates user data atoms within an MP4 container. When the function receives a malformed MP4 file containing unexpected or missing atom structures, it accesses a pointer without first validating that the pointer is non-NULL.

Dereferencing the NULL pointer triggers a segmentation fault, terminating the MP4Box process. The condition affects integrity of media-processing workflows that rely on MP4Box for muxing, demuxing, or metadata extraction. Automated pipelines processing untrusted user uploads are especially exposed because a single malformed file halts the worker.

Root Cause

The root cause is missing input validation inside gf_isom_get_user_data_count in isomedia/isom_read.c. The function assumes that internal data structures populated during MP4 parsing are present and well-formed. When an attacker-supplied file omits or corrupts the expected user data box (udta), the parser leaves the relevant pointer uninitialized or NULL. The subsequent dereference triggers the crash.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious MP4 file and delivers it through email, file shares, web downloads, or upload portals. When a user or automated service invokes MP4Box against the file, the parser reaches the vulnerable function and crashes. A proof-of-concept MP4 file is available at the GitHub PoC repository. Additional context is published in the InfoSec Exchange post.

Detection Methods for CVE-2025-55651

Indicators of Compromise

Unexpected termination or segmentation fault of MP4Box or gpac processes during media processing
Core dump files referencing gf_isom_get_user_data_count or isom_read.c in the stack trace
MP4 files with malformed or missing udta atom structures arriving from untrusted sources

Detection Strategies

Monitor process exit codes from MP4Box workers in transcoding and media pipelines for abnormal crashes
Inspect MP4 files at ingress with format validators that flag malformed atom hierarchies before they reach GPAC
Correlate crash telemetry on hosts running GPAC v2.4 with the source of the input file to identify malicious uploads

Monitoring Recommendations

Enable core dump collection on systems running MP4Box and review traces referencing the vulnerable function
Alert on repeated MP4Box crashes from the same upload source or user account, indicating probing behavior
Track GPAC version inventories across endpoints and servers to identify systems still running v2.4

How to Mitigate CVE-2025-55651

Immediate Actions Required

Identify all hosts and containers running GPAC MP4Box v2.4 and prioritize them for remediation
Restrict MP4Box execution to trusted input sources until a patched build is deployed
Run media-processing workers under least-privilege accounts inside sandboxed or containerized environments to contain crashes

Patch Information

No vendor patch reference is listed in the current NVD record for CVE-2025-55651. Monitor the GPAC project repository for an upstream fix to gf_isom_get_user_data_count in isomedia/isom_read.c and upgrade beyond GPAC v2.4 once the corrected build is published.

Workarounds

Validate MP4 file structure with an independent parser before invoking MP4Box on untrusted input
Isolate MP4Box execution within ephemeral containers so that a crash does not affect the host or sibling jobs
Implement automatic worker restart and rate limiting to absorb DoS attempts against media-processing services

bash

# Configuration example: run MP4Box in an isolated, auto-restarting container
docker run --rm --read-only --network=none \
  --memory=512m --pids-limit=64 \
  -v /input:/input:ro -v /output:/output \
  gpac/gpac:patched MP4Box -info /input/file.mp4