CVE-2025-15668: GPAC Heap Buffer Overflow in MP4Box sgpd_del_entry

Technical summary

CVE-2025-15668 is a heap buffer overflow in GPAC versions up to b40ce70f5, specifically in the sgpd_del_entry function within src/isomedia/box_code_base.c. The vulnerability stems from insufficient input validation on the data parameter passed to this function, allowing an attacker to write beyond allocated heap memory boundaries. This touches on both improper buffer sizing (CWE-122) and buffer overflow write operations (CWE-119). Exploitation requires local file system access and the ability to invoke MP4Box with a specially crafted MP4 file or stream. The CVSS v3.1 score of 3.3 (LOW) reflects the local-only attack vector and minimal confidentiality or integrity impact in most default configurations, though availability can be compromised through denial of service.

Business impact

For organizations relying on GPAC for automated MP4 processing, transcoding, or media ingestion pipelines, this vulnerability poses a denial-of-service risk. If GPAC services run with elevated privileges or within trusted processing workflows, a malicious or compromised MP4 file could disrupt media operations. The impact is typically limited to service unavailability rather than data breach, but in defense-in-depth scenarios where MP4 processing is a critical pipeline stage, availability loss can cascade. Organizations using GPAC in embedded or containerized environments should assess whether the local access requirement is truly a barrier in their threat model.

Affected systems

GPAC versions up to commit b40ce70f5 are vulnerable. This includes various release versions depending on when they were cut relative to that commit hash. The vulnerable component is MP4Box, GPAC's command-line tool for MP4 file manipulation and inspection. Any system or service that processes untrusted MP4 files using vulnerable GPAC versions is at risk. This includes media servers, streaming platforms, content delivery pipelines, and multimedia analysis tools. Verify your specific GPAC version against the commit timeline to confirm vulnerability status; patch commit f29f955f2a3b5e8e507caad3e52319f961bf37bf addresses the issue.

Exploitability

Exploit code is publicly available, lowering the barrier to weaponization. However, practical exploitation is constrained by the local access requirement—an attacker must either have shell access to the affected system or the ability to place a malicious MP4 file in a location where GPAC will process it. The exploit does not require authentication or special privileges to trigger, and the attack surface is straightforward: supply a crafted MP4 file to MP4Box. In environments where GPAC is exposed via web interfaces or where users can upload media files without strict validation, the local access barrier becomes less meaningful. Public availability of working exploits means detection evasion is less of a concern than rapid patching.

Remediation

Apply the patch with commit hash f29f955f2a3b5e8e507caad3e52319f961bf37bf or upgrade to a released version containing this commit. Verify the patch details against official GPAC repositories. As an interim measure, restrict file upload capabilities to MP4 files only from trusted sources, disable MP4Box functionality if not actively required, and run GPAC services under minimal privilege accounts. Input validation on MP4 files—such as parsing and schema checks before MP4Box processing—can reduce risk but should not be relied upon as a primary control.

Patch guidance

Obtain the latest GPAC release or build from the repository tip if a formal release has not yet incorporated commit f29f955f2a3b5e8e507caad3e52319f961bf37bf. Verify the patch is present by checking the commit history or release notes. Test the patched version in a non-production environment with your typical MP4 workloads to ensure compatibility. For organizations using binary distributions, check the vendor's security advisories for release availability. If you maintain internal GPAC builds, cherry-pick the specified commit or merge the latest stable branch.

Detection guidance

Monitor for MP4Box invocations with unusual or malformed MP4 file arguments, particularly those involving sgpd (sample group description) box manipulation. Segment analysis tools or media inspection platforms should flag suspicious MP4 structure anomalies. System-level detection can focus on GPAC process crashes or unexpected termination, especially if GPAC runs under service accounts. File integrity monitoring on MP4 files entering processing pipelines may detect injected payloads. Log and alert on any GPAC service restarts or errors related to buffer operations. Behavioral detection is more practical than signature-based approaches given the input-dependent nature of exploitation.

Why prioritize this

Despite a LOW CVSS score, this vulnerability merits prompt attention in organizations with GPAC-dependent workflows. The availability of working exploit code and the simplicity of the attack vector—a single malicious file—make it attractive for disruption attacks. Prioritize patching if GPAC processes untrusted or user-supplied media, or if service availability is business-critical. Organizations with strict network segmentation and robust file validation may deprioritize this slightly, but public exploit availability argues for rapid remediation within 30–60 days.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects low severity due to the local attack vector (AV:L), low complexity to trigger (AC:L), and low privilege requirement (PR:L). The impact is confined primarily to availability (A:L), with no direct confidentiality or integrity compromise in the typical attack scenario. However, this score does not account for the public exploit availability or the potential for lateral movement if GPAC runs on a system where an attacker has already gained foothold. Context—such as whether GPAC is internet-facing or processes untrusted files—can elevate practical risk above the numerical CVSS score.

Frequently asked questions