CVE-2025-55660: GPAC MP4Box Stack Overflow DoS Vulnerability

CVE-2025-55660 Overview

CVE-2025-55660 is a stack overflow vulnerability [CWE-121] in GPAC MP4Box version 2.4. The flaw resides in the gf_opus_read_length function within media_tools/av_parsers.c. Attackers can trigger the vulnerability by supplying a crafted MP4 file to the MP4Box utility. Successful exploitation results in a Denial of Service (DoS) condition through process termination. The vulnerability requires local access and user interaction, as a victim must process the malicious MP4 file with MP4Box.

Critical Impact
Crafted MP4 files passed to GPAC MP4Box v2.4 cause a stack overflow in gf_opus_read_length, terminating the process and producing a Denial of Service condition.

Affected Products

GPAC MP4Box v2.4
GPAC media_tools/av_parsers.c parser component
Applications and pipelines that invoke GPAC for MP4/Opus media parsing

Discovery Timeline

2026-06-15 - CVE-2025-55660 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55660

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in the gf_opus_read_length function of GPAC. The function is part of the audio/video parsing logic in media_tools/av_parsers.c and handles Opus codec length data within MP4 containers. When MP4Box processes a malformed MP4 file, the function writes beyond the bounds of a stack buffer. The overflow corrupts adjacent stack memory, including saved frame pointers and return addresses, causing the MP4Box process to crash.

Exploitation requires local access. An attacker must deliver a crafted MP4 file and convince a user to process it with MP4Box. The CVSS vector indicates the impact is limited to availability, with no confidentiality or integrity loss reported. The EPSS score of 0.181% reflects a low likelihood of observed exploitation in the wild.

Root Cause

The root cause is insufficient bounds validation when reading length-encoded Opus data from the MP4 container. The gf_opus_read_length function does not adequately constrain the parsed length value against the destination stack buffer size. A crafted file supplying oversized length fields causes the function to overrun its local buffer.

Attack Vector

The attack vector is local file processing. An attacker crafts a malicious MP4 file containing malformed Opus length data. The victim opens or processes the file with MP4Box v2.4, either directly via command line or through an automated pipeline. The parser triggers the overflow and the process aborts. Automated media processing services that ingest untrusted MP4 input are at elevated risk because they meet the user-interaction prerequisite at scale.

No verified proof-of-concept code is published. See the Openwall OSS Security advisory and the Infosec Exchange disclosure post for technical details.

Detection Methods for CVE-2025-55660

Indicators of Compromise

Unexpected crashes or SIGSEGV / SIGABRT termination of MP4Box processes during media ingestion
Core dumps referencing gf_opus_read_length or av_parsers.c in the call stack
MP4 files with malformed Opus sample entries or anomalous length fields submitted to media pipelines

Detection Strategies

Hunt process telemetry for abnormal exits of MP4Box correlated with recently received MP4 files
Inspect MP4 input with a hardened parser to flag Opus length fields that exceed expected ranges before passing files to GPAC
Apply file-integrity monitoring to media ingestion directories and review files that immediately precede a MP4Box crash

Monitoring Recommendations

Capture and alert on crash events and core dumps from any host running GPAC utilities
Log every invocation of MP4Box, including the user, source path of the input file, and exit code
Track GPAC version inventory across servers and developer workstations to identify systems still on v2.4

How to Mitigate CVE-2025-55660

Immediate Actions Required

Identify all systems running GPAC MP4Box v2.4 and restrict processing of untrusted MP4 files
Run MP4Box in a sandboxed or containerized environment with resource limits and automatic restart policies
Route untrusted media through a validation layer that rejects malformed Opus length fields before invoking GPAC

Patch Information

No vendor patch is referenced in the published CVE data. Monitor the GPAC project advisories and upstream repository for an updated release that supersedes v2.4 and corrects gf_opus_read_length. Upgrade as soon as a fixed version is published.

Workarounds

Avoid processing MP4 files from untrusted sources with MP4Box v2.4 until a patched build is available
Execute MP4Box under a non-privileged service account with ulimit constraints to contain crashes
Wrap MP4Box invocations with watchdog logic that detects abnormal exits and quarantines the offending input file

bash

# Run MP4Box under a restricted user with resource limits and crash isolation
sudo -u media-sandbox \
  systemd-run --scope --uid=media-sandbox \
    --property=MemoryMax=512M \
    --property=TasksMax=64 \
    --property=NoNewPrivileges=yes \
    MP4Box -info /var/spool/media/inbound/${FILE}