CVE-2025-55661: GPAC MP4Box Heap Buffer Overflow DoS Flaw

CVE-2025-55661 Overview

CVE-2025-55661 is a heap buffer overflow vulnerability in the Opus audio stream parser component of GPAC MP4Box version 2.4. An attacker can trigger the flaw by supplying a crafted MP4 file to the parser, resulting in a denial of service condition. The vulnerability is categorized as [CWE-122] Heap-based Buffer Overflow. Exploitation requires local access and user interaction, since a victim must process the malicious file with MP4Box. The flaw affects availability only, with no impact on confidentiality or integrity. GPAC is widely used as a multimedia framework and command-line toolkit for MP4 packaging, making this issue relevant for media processing pipelines and automation workflows.

Critical Impact
A crafted MP4 file processed by GPAC MP4Box v2.4 causes a heap buffer overflow in the Opus parser, terminating the process and producing a denial of service.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (Opus audio stream parser component)
Tools and pipelines that invoke MP4Box for MP4 packaging or remuxing

Discovery Timeline

2026-06-15 - CVE-2025-55661 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55661

Vulnerability Analysis

The vulnerability resides in the Opus audio stream parser inside GPAC MP4Box v2.4. When MP4Box parses an MP4 container that embeds a malformed Opus audio stream, the parser writes beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap memory and crashes the process. Because the CVSS vector indicates no confidentiality or integrity impact, the documented outcome is restricted to denial of service rather than arbitrary code execution. Exploitation requires the victim to invoke MP4Box on the attacker-supplied file, which aligns with the user interaction requirement.

Root Cause

The root cause is missing or insufficient bounds validation on length or size fields parsed from the Opus stream prior to writing into a heap buffer. The parser trusts attacker-controlled values from the MP4 container, allowing writes that exceed the allocated buffer. This is a classic [CWE-122] heap-based buffer overflow pattern in multimedia demuxers, where complex container formats provide many fields that influence allocation and copy operations.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted MP4 file through email attachments, file shares, web downloads, or as part of an automated media ingestion pipeline. When MP4Box processes the file, the parser corrupts the heap and the process aborts. In automated pipelines, repeated processing of the malicious file can disrupt batch jobs and downstream services that depend on MP4Box output.

No verified public proof-of-concept code is available. Technical details and discussion are tracked in the OpenWall OSS Security mailing list post and the InfoSec Exchange advisory.

Detection Methods for CVE-2025-55661

Indicators of Compromise

Unexpected crash or abort of the MP4Box process when handling MP4 files containing Opus audio tracks
Heap corruption signatures from glibc (for example, malloc(): unsorted double linked list corrupted) emitted by MP4Box
Core dumps generated by MP4Box during automated media processing jobs
MP4 files with anomalous or oversized Opus configuration fields entering media ingestion pipelines

Detection Strategies

Run MP4Box under AddressSanitizer (ASan) in test environments to catch heap out-of-bounds writes against suspicious files
Monitor process exit codes and crash telemetry from systems that invoke MP4Box in scheduled or batch workflows
Implement file type and structural validation on inbound MP4 files before they reach the parser

Monitoring Recommendations

Collect and alert on MP4Box process crashes via host telemetry and system logs (journalctl, dmesg, core dump handlers)
Track GPAC version inventory across servers and developer workstations to identify exposed v2.4 installations
Log media processing pipeline failures with the originating file hash to support forensic review

How to Mitigate CVE-2025-55661

Immediate Actions Required

Inventory all systems running GPAC and identify hosts on version 2.4 of MP4Box
Restrict processing of untrusted MP4 files until a fixed GPAC release is deployed
Sandbox MP4Box execution in containers or isolated user accounts with minimal privileges
Validate the source and structure of MP4 files entering automated media pipelines

Patch Information

At the time of publication, no fixed version is referenced in the NVD entry. Monitor the GPAC project releases and the OpenWall OSS Security mailing list for an official patched build. Upgrade GPAC to the first release that addresses the Opus parser heap overflow once available.

Workarounds

Disable Opus audio handling in workflows that do not require it, or strip Opus tracks before invoking MP4Box
Process untrusted MP4 files inside short-lived containers with resource limits and automatic restart policies
Apply file size and MIME validation at ingress to drop malformed or oversized MP4 inputs
Run MP4Box with restricted filesystem access using tools such as firejail, bubblewrap, or systemd-run --user

bash

# Example: sandbox MP4Box execution with systemd-run to contain crashes
systemd-run --user --scope \
  --property=MemoryMax=512M \
  --property=TasksMax=64 \
  --property=PrivateTmp=yes \
  MP4Box -info /path/to/untrusted.mp4