CVE-2025-55658 Overview
CVE-2025-55658 is a denial-of-service vulnerability in GPAC MP4Box version 2.4. The flaw resides in the gf_opus_parse_packet_header function within media_tools/av_parsers.c. A floating point exception occurs when the parser processes a crafted MP4 file containing malformed Opus audio data. Attackers can trigger the condition by convincing a user to open or process a malicious media file with MP4Box. The vulnerability is classified under [CWE-1077] (Floating Point Comparison with Incorrect Operator). Exploitation results in process termination, disrupting media processing workflows that depend on the GPAC toolkit.
Critical Impact
A crafted MP4 file triggers a floating point exception in MP4Box, crashing the process and producing a denial-of-service condition for media processing pipelines.
Affected Products
- GPAC MP4Box v2.4
- GPAC multimedia framework components linking media_tools/av_parsers.c
- Applications and pipelines that embed the vulnerable GPAC libraries for MP4 parsing
Discovery Timeline
- 2026-06-09 - CVE-2025-55658 published to the National Vulnerability Database
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2025-55658
Vulnerability Analysis
The vulnerability sits in GPAC's Opus packet header parser. The gf_opus_parse_packet_header function in media_tools/av_parsers.c performs arithmetic on values extracted from attacker-controlled MP4 input. When a crafted file supplies a value that produces a divide-by-zero or undefined floating point operation, the process raises SIGFPE and terminates.
The issue is reachable through standard MP4Box command-line invocations and through any application that links the affected GPAC parsing routines. No authentication is required to deliver the malicious file, but a user must open or process the file for the crash to occur.
Impact is limited to availability. The vulnerability does not corrupt memory, leak data, or permit code execution. Pipelines that process untrusted MP4 content — transcoding services, media ingestion workers, and analysis sandboxes — face repeated worker termination if attackers submit crafted samples.
Root Cause
The root cause is missing input validation on parsed Opus header fields before they are used in arithmetic operations. The parser trusts container-supplied values without bounds checking, allowing zero or out-of-range operands to reach floating point math. This pattern matches [CWE-1077], where floating point comparisons or operations execute on unvalidated input.
Attack Vector
An attacker crafts an MP4 file with malformed Opus packet header fields and delivers it through any channel that feeds MP4Box or GPAC-linked tooling. Delivery vectors include email attachments, web downloads, upload endpoints for media services, and automated ingestion queues. Each invocation against the crafted file terminates the process. Repeated submission sustains the denial-of-service condition.
No verified public proof-of-concept code is available. See the InfoSec Exchange Post for additional technical context.
Detection Methods for CVE-2025-55658
Indicators of Compromise
- Repeated MP4Box process terminations with SIGFPE (signal 8) exit codes in system logs
- Crash dumps referencing gf_opus_parse_packet_header or av_parsers.c in the stack trace
- Spikes in failed media transcoding jobs tied to specific MP4 inputs containing Opus audio tracks
Detection Strategies
- Monitor process exit codes from MP4Box and GPAC-linked services for floating point exception terminations
- Inspect uploaded MP4 samples in a sandboxed parser to flag files that crash GPAC tooling
- Correlate ingestion queue failures with source IPs or accounts submitting the offending files
Monitoring Recommendations
- Forward GPAC process crash telemetry and core dump metadata to a centralized logging platform
- Track per-file processing failure rates in media pipelines and alert on anomalous spikes
- Retain crashing input samples for offline analysis to confirm the floating point exception signature
How to Mitigate CVE-2025-55658
Immediate Actions Required
- Inventory all systems running GPAC MP4Box v2.4 and dependent applications that link GPAC parsing libraries
- Restrict MP4Box execution to sandboxed workers with strict resource and restart policies
- Block or quarantine MP4 files from untrusted sources until they pass validation in an isolated parser
Patch Information
No vendor advisory or fixed version is referenced in the published CVE data. Track the GPAC project for upstream commits to media_tools/av_parsers.c that add bounds checking to gf_opus_parse_packet_header, and apply updates as they become available.
Workarounds
- Run MP4Box inside container or systemd sandboxes with automatic restart to absorb crashes
- Pre-screen Opus-bearing MP4 files with an independent parser before passing them to GPAC
- Disable Opus audio handling in GPAC builds where the codec is not required for the workload
# Configuration example: restart MP4Box workers automatically after SIGFPE crashes
# /etc/systemd/system/mp4box-worker.service
[Service]
ExecStart=/usr/local/bin/mp4box-worker
Restart=always
RestartSec=2
NoNewPrivileges=true
PrivateTmp=true
ProtectSystem=strict
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
