CVE-2025-15667: GPAC MP4Box Double-Free Vulnerability – Local Denial of Service

Technical summary

CVE-2025-15667 is a double-free vulnerability (CWE-415) in GPAC up to version 2.5-DEV, specifically within the MP4 media file parsing component. The vulnerability occurs in the `gf_isom_nalu_sample_rewrite` function in `src/isomedia/avc_ext.c`. By supplying a crafted value for the `nalu_out_bs` argument, an attacker can cause the code path to attempt freeing the same memory buffer twice during the NALU (Network Abstraction Layer Unit) sample rewriting process. This triggers a heap corruption condition. The CVSS 3.1 vector reflects local attack surface (AV:L), low complexity (AC:L), and limited privilege requirement (PR:L), resulting in a base score of 3.3 with availability impact only. The related CWE-119 (Buffer Overflow) is also listed, suggesting potential memory access control issues in the broader code path.

Business impact

For organizations using GPAC for media transcoding, validation, or processing workflows, this vulnerability poses a limited but real denial-of-service risk. If GPAC MP4Box is deployed in production pipelines—particularly in unattended batch processing, media ingest systems, or automated content workflows—a malicious or corrupted MP4 file could crash the service and interrupt processing. The impact is primarily operational rather than data-confidentiality focused, since the vulnerability only affects availability. However, if GPAC runs with elevated privileges or in a shared environment, the crash could affect other services. Organizations not directly using GPAC are unaffected.

Affected systems

GPAC versions up to 2.5-DEV are affected. The vulnerability is triggered via local file processing, so it requires an attacker to either (1) place a malicious MP4 file on the target system where GPAC will process it, or (2) have local code execution capability to invoke GPAC with a crafted input. End users who consume GPAC-processed media, or who download MP4 files, are not at direct risk; the vulnerability requires the victim system to actively process the file with a vulnerable version of GPAC.

Exploitability

The vulnerability is not classified as KEV (Known Exploited Vulnerability) and is not listed in the US CISA catalog. However, the CVE description explicitly notes that proof-of-concept or exploitation details have been publicly disclosed. This means the technical barrier to weaponization is low for actors with development resources. Exploitation requires local access and the ability to cause GPAC to process a specially crafted MP4 file. The CVSS vector (PR:L—low privilege required) indicates the attacker does not need administrative rights, reducing the barrier further. The attack is reliable and deterministic once the precise file format is crafted.

Remediation

Apply the patch identified as commit `f29f955f2a3b5e8e507caad3e52319f961bf37bf`. Users should update GPAC to a version that includes this commit. If GPAC is used via a package manager or third-party application, check for available updates and security advisories from your software vendor. Until patched, restrict file processing to trusted sources and monitor GPAC processes for unexpected crashes.

Patch guidance

Verify that your GPAC installation includes commit `f29f955f2a3b5e8e507caad3e52319f961bf37bf` or a later version from the GPAC project. Consult the official GPAC release notes and GitHub repository to confirm the patch version. If GPAC is bundled within a third-party product (transcoder, player, media framework), contact that vendor for an updated release. Patch testing should focus on verifying that previously problematic MP4 files no longer trigger crashes and that normal media processing workflows remain functional.

Detection guidance

Monitor GPAC process logs and system crash dumps for instances of heap corruption or double-free errors. Endpoint detection tools can flag unexpected terminations of GPAC processes. Network-based detection is difficult since the attack surface is local file processing; however, in a centralized media-processing architecture, monitor ingest pipelines for unexplained service interruptions after MP4 file uploads. Correlate GPAC crashes with specific file inputs to identify potential attack vectors. Review access logs to determine who can place files in GPAC processing directories.

Why prioritize this

Although the CVSS score is low (3.3), this vulnerability warrants timely attention if GPAC is active in your environment, particularly in critical media workflows. The public disclosure of exploitation details removes the 'unknown' factor and increases real-world exploitation likelihood. The availability impact, while limited in scope, can cascade in production systems. Prioritize patching for systems where GPAC is exposed to untrusted input files (user uploads, external feeds, etc.). For isolated or non-critical uses, this can be addressed in a regular maintenance window.

Risk score, explained

The CVSS 3.1 base score of 3.3 reflects the local-only attack vector and the availability-only impact. The score does not increase for confidentiality or integrity because the double-free does not permit reliable code execution or data leakage in its current form; it is a denial-of-service primitive. The low privilege requirement slightly elevates concern within multi-user or shared-service environments. Context matters: in an air-gapped or tightly controlled media processing cluster, risk is minimal; in a system accepting diverse file sources from the internet, risk is elevated relative to the base score.

Frequently asked questions