CVE-2025-55652 Overview
CVE-2025-55652 is a heap buffer overflow vulnerability in the gf_isom_vp_config_new function located in isomedia/avc_ext.c of GPAC MP4Box version 2.4. The flaw allows a local attacker to trigger a Denial of Service (DoS) condition by supplying a crafted MP4 file to the multimedia framework. GPAC is an open-source multimedia framework widely used for processing MP4 and other container formats. The vulnerability is tracked under CWE-122: Heap-based Buffer Overflow.
Critical Impact
Successful exploitation crashes the MP4Box process, disrupting media processing workflows that rely on GPAC for parsing or manipulating MP4 container files.
Affected Products
- GPAC MP4Box version 2.4
- GPAC multimedia framework (gpac:gpac)
- Applications and pipelines embedding the vulnerable gf_isom_vp_config_new parser
Discovery Timeline
- 2026-06-15 - CVE-2025-55652 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55652
Vulnerability Analysis
The vulnerability resides in gf_isom_vp_config_new, a function in isomedia/avc_ext.c responsible for parsing VP codec configuration boxes inside MP4 containers. When MP4Box processes a malformed MP4 file, the function performs a heap allocation or write operation without correctly validating the size or bounds derived from attacker-controlled input. The result is an out-of-bounds write on the heap, corrupting adjacent memory and forcing the process to terminate.
The attack requires local access and user interaction, typically by convincing a user or automated pipeline to open the crafted MP4 file. Confidentiality and integrity are not impacted, but availability is fully compromised because the process aborts.
Root Cause
The root cause is insufficient bounds checking when constructing VP codec configuration structures from untrusted MP4 box data. Container fields parsed from the file feed directly into heap operations without validation, enabling memory corruption classified under [CWE-122].
Attack Vector
An attacker delivers a crafted MP4 file to a target system running MP4Box 2.4. When the file is processed, parsing reaches gf_isom_vp_config_new, triggering the heap overflow and crashing MP4Box. Automated media conversion services that ingest user-supplied MP4 files are particularly exposed to repeated DoS conditions.
No verified public proof-of-concept code is available. Technical details are referenced in the OpenWall OSS Security List and an InfoSec Exchange Post.
Detection Methods for CVE-2025-55652
Indicators of Compromise
- Unexpected crashes or segmentation faults from the MP4Box process during MP4 ingestion
- Heap corruption signatures in core dumps referencing gf_isom_vp_config_new or avc_ext.c
- Repeated failed media processing jobs tied to a specific input MP4 file
Detection Strategies
- Monitor system logs and crash reporting for abnormal MP4Box terminations correlated with MP4 file processing
- Enable AddressSanitizer (ASan) or heap protection in non-production environments to surface heap overflows during parsing
- Inspect MP4 files for malformed VP codec configuration boxes prior to feeding them into GPAC
Monitoring Recommendations
- Track the GPAC binary version across endpoints and build pipelines to identify hosts running version 2.4
- Alert on repeated MP4Box process exits with non-zero status in media transcoding workflows
- Capture telemetry from EDR tooling on unexpected process termination events involving multimedia utilities
How to Mitigate CVE-2025-55652
Immediate Actions Required
- Avoid processing untrusted MP4 files with GPAC MP4Box version 2.4 until a patched build is deployed
- Restrict local execution of MP4Box to trusted users and sandbox media processing workloads
- Validate or pre-scan inbound MP4 files in automated pipelines to reject malformed containers
Patch Information
At the time of publication, no fixed GPAC release is referenced in the NVD entry. Monitor the GPAC project repository and the OpenWall OSS Security List for upstream commits addressing gf_isom_vp_config_new in isomedia/avc_ext.c. Rebuild from source once the fix is merged or upgrade to a release that supersedes version 2.4.
Workarounds
- Run MP4Box inside a restricted container or sandbox with resource limits to contain crashes
- Disable automated MP4 ingestion from untrusted sources until patched binaries are available
- Apply seccomp or AppArmor profiles to limit the blast radius of a corrupted MP4Box process
# Example: confirm installed GPAC version and restrict MP4Box execution
MP4Box -version 2>&1 | head -n 1
# Run MP4Box under a restricted user with limited resources
sudo -u mediaproc bash -c 'ulimit -v 524288; MP4Box -info /path/to/input.mp4'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
