CVE-2025-55663: Gpac MP4Box DoS Vulnerability

CVE-2025-55663 Overview

CVE-2025-55663 is a null pointer dereference vulnerability [CWE-476] in GPAC MP4Box version 2.4. The flaw resides in the Track_SetStreamDescriptor function within isomedia/track.c. A crafted MP4 file triggers a segmentation violation when processed, causing the application to crash. The vulnerability requires local access and user interaction, since the victim must open or process the malicious media file with MP4Box. Successful exploitation results in a Denial of Service (DoS) of the GPAC process. The issue affects environments that use GPAC for multimedia processing, transcoding, or automated MP4 handling workflows.

Critical Impact
Attackers can crash GPAC MP4Box by supplying a crafted MP4 file, disrupting media processing pipelines and any automated workflows that rely on the tool.

Affected Products

GPAC MP4Box v2.4
GPAC multimedia framework (gpac:gpac)
Applications and pipelines embedding the GPAC isomedia library

Discovery Timeline

2026-06-15 - CVE-2025-55663 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55663

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Track_SetStreamDescriptor function in isomedia/track.c. GPAC parses ISO Base Media File Format (ISOBMFF) containers, including MP4 files, and constructs track and stream descriptor structures during parsing. When the parser encounters a malformed or unexpected combination of atoms, the function operates on a pointer that has not been initialized, returning NULL from an upstream allocation or lookup. Dereferencing this pointer triggers a segmentation violation that terminates the MP4Box process.

The attacker has no control over execution flow beyond crashing the process. The bug does not corrupt heap metadata or yield memory disclosure. Impact is limited to availability, consistent with the local attack vector and the requirement for user interaction.

Root Cause

The root cause is missing validation of a pointer returned during stream descriptor setup. Track_SetStreamDescriptor assumes a referenced object exists for the parsed track entry. A crafted MP4 file omits or reorders the expected structures, leaving the pointer NULL. The function then accesses a field through the pointer without a prior check, faulting at the invalid memory access.

Attack Vector

Exploitation requires an attacker to deliver a crafted MP4 file to a system running GPAC MP4Box and convince a user, automated job, or service to process it. The attack vector is local, and user interaction is required. The vulnerability does not yield code execution, but repeated submissions can disable transcoding services, batch media converters, or CI pipelines that invoke MP4Box on untrusted input. See the Openwall OSS Security List post for technical context.

No public proof-of-concept exploit code is referenced in the advisory. Technical details are described in prose only.

Detection Methods for CVE-2025-55663

Indicators of Compromise

Unexpected SIGSEGV crashes of the MP4Box or gpac binary recorded in system logs, core dumps, or systemd-coredump entries.
MP4 files submitted to processing pipelines that fail parsing inside isomedia/track.c at Track_SetStreamDescriptor.
Repeated failures in media transcoding queues correlated with specific user-supplied MP4 uploads.

Detection Strategies

Hunt for process termination events where MP4Box exits with a segmentation fault signal across endpoints and build servers.
Inspect application logs for GPAC parsing errors referencing Track_SetStreamDescriptor or track descriptor initialization failures.
Correlate file upload events with subsequent crashes of media processing services to identify malicious inputs.

Monitoring Recommendations

Enable core dump collection on hosts running GPAC and forward crash metadata to centralized logging.
Alert when the same user or source repeatedly submits MP4 files that cause MP4Box to crash.
Track GPAC version inventory across endpoints, servers, and container images to identify exposure to version 2.4.

How to Mitigate CVE-2025-55663

Immediate Actions Required

Identify all hosts, containers, and pipelines that include GPAC 2.4 or earlier and prioritize them for update.
Restrict MP4Box execution to trusted inputs only, and isolate processing of user-submitted media in sandboxed workers.
Apply resource limits and automatic restart policies so a crash does not halt downstream services.

Patch Information

No fixed version is referenced in the NVD entry at publication. Monitor the GPAC project advisory channel and the Openwall OSS Security List for upstream patches addressing Track_SetStreamDescriptor in isomedia/track.c. Rebuild from source once an upstream commit lands, or upgrade to the next stable GPAC release.

Workarounds

Avoid processing MP4 files from untrusted sources with MP4Box until a patched build is deployed.
Run MP4Box under a process supervisor that restarts the service after a crash to preserve availability.
Wrap MP4Box invocations in sandboxes such as firejail, bubblewrap, or seccomp-confined containers to contain crashes.
Validate MP4 file structure with a separate hardened parser before passing files to GPAC.

bash

# Configuration example: run MP4Box inside a restricted sandbox
firejail --quiet --net=none --private-tmp \
  --read-only=/usr/bin/MP4Box \
  MP4Box -info /input/untrusted.mp4