CVE-2025-55659: GPAC MP4Box DoS Vulnerability

CVE-2025-55659 Overview

CVE-2025-55659 is a NULL pointer dereference vulnerability in GPAC MP4Box version 2.4. The flaw resides in the ctts_box_write function within isomedia/box_code_base.c. Attackers can trigger the dereference by supplying a crafted MP4 file to the application. Successful exploitation causes the process to crash, resulting in a Denial of Service (DoS) condition. The vulnerability is classified under [CWE-476] (NULL Pointer Dereference) and requires user interaction to open or process the malicious file.

Critical Impact
A crafted MP4 file processed by GPAC MP4Box v2.4 forces a NULL pointer dereference in ctts_box_write, terminating the process and denying service to users relying on the multimedia framework.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (isomedia/box_code_base.c component)
Applications and pipelines embedding the affected MP4Box version for media processing

Discovery Timeline

2026-06-09 - CVE-2025-55659 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2025-55659

Vulnerability Analysis

The vulnerability exists in GPAC, an open source multimedia framework widely used for packaging, streaming, and analyzing MP4 and ISO Base Media File Format (ISOBMFF) content. The ctts_box_write function handles serialization of the Composition Time to Sample (ctts) box during MP4 file processing. When MP4Box parses a malformed file lacking expected internal structures, the function dereferences a pointer that was never initialized or was explicitly NULL.

Dereferencing the NULL pointer causes an immediate segmentation fault. The process terminates without controlled error handling. While the impact is limited to availability, automated media processing pipelines and batch transcoding workflows can be disrupted by a single malicious input file.

Root Cause

The root cause is missing validation of a structure pointer inside ctts_box_write in isomedia/box_code_base.c. The function assumes the sample entry or related sub-structure is allocated and populated before writing. A crafted MP4 file can produce a parser state where this assumption no longer holds, leading the write routine to access memory through a NULL pointer.

Attack Vector

An attacker delivers a crafted MP4 file to a victim or to a service that automatically processes uploaded media. Processing the file with MP4Box v2.4 triggers the crash. The attack requires user interaction or automated ingestion, but no authentication or elevated privileges. Confidentiality and integrity are not impacted, only availability of the MP4Box process and any dependent workflow.

No public proof-of-concept exploit code is referenced in the available advisories. See the InfoSec Exchange Post for the original disclosure details.

Detection Methods for CVE-2025-55659

Indicators of Compromise

Repeated crashes or segmentation faults of the MP4Box binary during media ingestion or transcoding.
Core dumps referencing ctts_box_write or isomedia/box_code_base.c in the stack trace.
Unexpected MP4 files arriving from untrusted users or external sources immediately preceding service interruption.

Detection Strategies

Monitor process exit codes and abnormal termination signals (SIGSEGV) from MP4Box invocations.
Inspect application logs for parser errors emitted by GPAC immediately before a crash.
Apply file integrity and structural validation on inbound MP4 files prior to passing them to MP4Box.

Monitoring Recommendations

Centralize logs from media processing hosts and alert on repeated MP4Box crashes within short time windows.
Track the version of GPAC deployed across hosts and flag instances still running v2.4.
Correlate user upload events with subsequent worker crashes to identify potential abuse.

How to Mitigate CVE-2025-55659

Immediate Actions Required

Identify all systems running GPAC MP4Box v2.4 and restrict their exposure to untrusted MP4 files.
Place media processing workers in isolated, restartable containers so a crash does not propagate to other services.
Validate and sanitize inbound MP4 files using an independent parser before invoking MP4Box.

Patch Information

No vendor patch reference is included in the available CVE data. Monitor the GPAC project releases and the InfoSec Exchange disclosure for an updated build that addresses the ctts_box_write NULL pointer dereference. Upgrade to a fixed version once published by the maintainers.

Workarounds

Reject or quarantine MP4 files from untrusted sources until a patched GPAC build is deployed.
Run MP4Box under a process supervisor that automatically restarts the worker after abnormal exits to limit service disruption.
Constrain MP4Box execution with resource limits and seccomp or AppArmor profiles to contain the impact of a crash.

bash

# Configuration example: supervised, sandboxed MP4Box invocation
systemd-run --scope \
  --property=MemoryMax=512M \
  --property=Restart=on-failure \
  --uid=mp4box --gid=mp4box \
  /usr/bin/MP4Box -info /var/spool/media/incoming.mp4