CVE-2025-55664: GPAC MP4Box DoS Vulnerability

CVE-2025-55664 Overview

CVE-2025-55664 is a heap buffer overflow vulnerability in the m2tsdmx_send_packet function located in filters/dmx_m2ts.c of GPAC MP4Box version 2.4. Attackers can trigger the flaw by supplying a crafted MP4 file, leading to a denial-of-service (DoS) condition in the affected process. The weakness is classified under [CWE-122] (Heap-based Buffer Overflow). Exploitation requires local access and user interaction, such as opening or processing the malicious media file with MP4Box. While the issue does not enable code execution or information disclosure in its documented form, it impacts availability of the application.

Critical Impact
A crafted MP4 file processed by GPAC MP4Box v2.4 causes a heap buffer overflow in the MPEG-2 TS demuxer, resulting in denial of service.

Affected Products

GPAC MP4Box v2.4
GPAC framework component filters/dmx_m2ts.c
Downstream tools and pipelines embedding the vulnerable GPAC demuxer

Discovery Timeline

2026-06-01 - CVE-2025-55664 published to the National Vulnerability Database (NVD)
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2025-55664

Vulnerability Analysis

The vulnerability resides in the MPEG-2 Transport Stream (TS) demuxer of GPAC, specifically inside the m2tsdmx_send_packet function in src/filters/dmx_m2ts.c. When the demuxer processes DVB subtitle streams (GF_M2TS_DVB_SUBTITLE), it advances the data pointer by two bytes to skip the dataID and stream ID fields and decrements the remaining length accordingly. The function does not validate that the available payload length is at least two bytes before performing this adjustment.

A crafted MP4 file can supply a DVB subtitle packet with a payload length of fewer than two bytes. The unchecked arithmetic causes the length variable to underflow and the pointer to advance past the allocated heap buffer. Subsequent reads or downstream processing operate on memory outside the intended allocation, producing a heap buffer overflow and crashing the process.

Root Cause

The root cause is missing input validation on the DVB subtitle payload length before pointer arithmetic. Without a guard such as if (len<=2) return;, the demuxer trusts attacker-controlled length fields embedded in the media container, violating safe parsing assumptions for untrusted input.

Attack Vector

Exploitation requires a local attacker to deliver a crafted MP4 file and convince a user to process it with a vulnerable GPAC MP4Box build. The impact is limited to availability; confidentiality and integrity are not affected. No authentication is required, but user interaction is necessary to load the malicious file.

// Security patch in src/filters/dmx_m2ts.c - Fixed #3310
	//skip dataID and stream ID
	if (pck->stream->stream_type==GF_M2TS_DVB_SUBTITLE) {
+		if (len<=2) return;
		ptr+=2;
		len-=2;
	}
// Source: https://github.com/gpac/gpac/commit/9bd6a72c9efc0513dfd33b87498afc7658dabd26

The patch adds an explicit length check that aborts processing when the subtitle payload is too short to contain the dataID and stream ID fields, preventing pointer overrun and length underflow.

Detection Methods for CVE-2025-55664

Indicators of Compromise

Unexpected crashes or aborts of MP4Box or other GPAC-based binaries while parsing MP4 or MPEG-2 TS files.
Heap corruption signatures in core dumps referencing m2tsdmx_send_packet or dmx_m2ts.c frames.
Inbound MP4 files containing malformed DVB subtitle PES packets with payload length fields under two bytes.

Detection Strategies

Fuzz test media ingestion pipelines using sanitizers (ASan/UBSan) to surface heap overflows in GPAC parsing paths.
Scan endpoints for installed GPAC versions and flag any builds at or before v2.4 that lack the commit 9bd6a72.
Inspect file submissions to media processing services for malformed MPEG-2 TS subtitle structures.

Monitoring Recommendations

Alert on repeated abnormal terminations of GPAC processes on workstations and media servers.
Forward application crash telemetry and Windows Error Reporting or systemd-coredump events to a centralized log platform for correlation.
Track file open events for .mp4 and .ts files immediately preceding GPAC process termination.

How to Mitigate CVE-2025-55664

Immediate Actions Required

Update GPAC to a build that includes commit 9bd6a72c9efc0513dfd33b87498afc7658dabd26 which fixes GPAC issue #3310.
Restrict execution of MP4Box to trusted media sources until patched.
Validate or quarantine untrusted MP4 and MPEG-2 TS files before processing in automated workflows.

Patch Information

The upstream fix is available in the GPAC repository via the GitHub commit update. Additional context is provided in the GitHub issue discussion and on the OpenWall oss-security mailing list. Rebuild GPAC from a commit later than the fix or use a distribution package that has incorporated the patch.

Workarounds

Avoid processing untrusted MP4 files with GPAC MP4Box v2.4 until the patched version is deployed.
Run MP4Box in a sandbox or container with strict resource limits to contain crashes.
Apply the upstream patch manually to src/filters/dmx_m2ts.c and rebuild if upgrading is not immediately feasible.

bash

# Build GPAC from source with the upstream fix
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 9bd6a72c9efc0513dfd33b87498afc7658dabd26
./configure --static-bin
make -j$(nproc)
sudo make install
MP4Box -version