CVE-2025-55657: GPAC MP4Box DoS Vulnerability

CVE-2025-55657 Overview

CVE-2025-55657 is a NULL pointer dereference vulnerability in GPAC MP4Box version 2.4. The flaw resides in the gf_odf_vvc_cfg_write_bs function within odf/descriptors.c. Attackers can trigger the condition by supplying a crafted MP4 file to the parser. Successful exploitation causes the MP4Box process to crash, resulting in a Denial of Service (DoS). The vulnerability is classified under [CWE-476] (NULL Pointer Dereference) and affects the availability of the application without compromising confidentiality or integrity. GPAC is a widely deployed open-source multimedia framework used for packaging, streaming, and processing video content, so the issue impacts media processing pipelines that ingest untrusted MP4 input.

Critical Impact
A remote, unauthenticated attacker can crash MP4Box by submitting a malformed MP4 file, disrupting media processing workflows.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (odf/descriptors.c component)
Downstream applications embedding the vulnerable VVC configuration writer

Discovery Timeline

2026-06-09 - CVE-2025-55657 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2025-55657

Vulnerability Analysis

The vulnerability is a NULL pointer dereference inside the gf_odf_vvc_cfg_write_bs function, which serializes Versatile Video Coding (VVC) configuration descriptors into an MP4 bitstream. When MP4Box parses a crafted file, the function receives a configuration structure that lacks expected substructures or array members. The code then dereferences a pointer that was never initialized, causing an immediate segmentation fault. Because MP4Box runs as a single process per file, the crash terminates the entire conversion or muxing job. Automated transcoding services that invoke MP4Box on user-supplied content are particularly exposed, as repeated submissions can interrupt pipelines and exhaust worker capacity.

Root Cause

The root cause is missing validation of pointer members within the VVC configuration descriptor before they are written to the output bitstream. The serializer in odf/descriptors.c assumes that nested arrays and parameter set lists are populated when the descriptor type is set. A crafted MP4 file can set the descriptor type while omitting or zeroing required substructure pointers, breaking that assumption.

Attack Vector

An unauthenticated remote attacker delivers a crafted MP4 file to any system that processes it with MP4Box. No user interaction beyond normal file handling is required. Typical delivery channels include upload portals, media transcoders, content ingestion APIs, and command-line workflows that wrap GPAC. The vulnerability cannot be exploited for code execution but can be used to disrupt media services.

No verified proof-of-concept code is publicly indexed for this issue. See the InfoSec Exchange Discussion for additional context on the crash condition.

Detection Methods for CVE-2025-55657

Indicators of Compromise

Unexpected MP4Box process termination with SIGSEGV when handling user-submitted MP4 files
Core dumps referencing gf_odf_vvc_cfg_write_bs or odf/descriptors.c in the stack trace
Repeated failed transcoding jobs originating from the same uploader or IP address

Detection Strategies

Monitor MP4Box exit codes and crash logs across media processing workers for abnormal failure rates.
Inspect MP4 files for VVC (vvcC) configuration boxes with malformed or empty parameter set arrays before passing them to GPAC.
Correlate file ingestion telemetry with worker crashes to identify malicious upload patterns.

Monitoring Recommendations

Enable verbose logging in MP4Box and forward stderr output to a centralized log platform.
Track per-tenant crash counts to identify sources attempting to weaponize crafted MP4 input.
Alert on repeated segmentation faults in container or sandbox runtimes that host GPAC.

How to Mitigate CVE-2025-55657

Immediate Actions Required

Restrict MP4Box invocation to sandboxed, resource-limited workers that auto-restart on crash.
Validate uploaded MP4 files with a hardened pre-parser before passing them to GPAC.
Reject or quarantine MP4 files containing malformed VVC configuration records pending review.

Patch Information

No official patch reference is recorded in the NVD entry at publication. Operators should track the GPAC project repository for fixes that add NULL checks within gf_odf_vvc_cfg_write_bs and rebuild MP4Box from a patched commit once available. Until then, treat all v2.4 deployments as vulnerable.

Workarounds

Disable VVC processing in MP4Box workflows that do not require it.
Run MP4Box under a process supervisor with crash isolation so a single malformed file cannot halt the broader pipeline.
Apply file-size and content-type policies at the ingestion layer to reduce the attack surface.

bash

# Configuration example: isolate MP4Box execution with systemd-run resource limits
systemd-run --scope --uid=mp4box --gid=mp4box \
  -p MemoryMax=512M \
  -p CPUQuota=50% \
  -p NoNewPrivileges=yes \
  -p PrivateTmp=yes \
  MP4Box -info /sandbox/input.mp4