CVE-2025-52292: GPAC MP4Box Stack Buffer Overflow Denial of Service

Technical summary

CVE-2025-52292 is a stack buffer overflow (CWE-121) located in the filein_process function of in_file.c within GPAC MP4Box v2.4. The vulnerability arises from insufficient bounds checking when processing input MP4 files. When a malformed MP4 file with crafted parameters is provided, the function writes beyond allocated stack memory, triggering a crash. The attack requires no authentication, no user interaction beyond file submission, and can be triggered over the network if MP4Box is exposed via a service endpoint. CVSS 3.1 score is 7.5 (High severity) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting network-accessible denial of service with no confidentiality or integrity impact.

Business impact

Organizations relying on GPAC MP4Box for automated media transcoding, validation, or ingest pipelines face service disruption risk. If MP4Box is exposed as a web service or integrated into media processing workflows, an attacker can cause repeated crashes, degrading availability. This affects streaming platforms, content management systems, and broadcast infrastructures. The impact is availability-focused; no data theft or corruption occurs. Recovery requires process restart and potential upstream queue management.

Affected systems

GPAC MP4Box v2.4 is the confirmed affected version. Organizations using earlier versions should verify end-of-life status with the vendor; later versions require testing for patch status. MP4Box is commonly used in Linux/Unix environments and containerized media pipelines. Products that embed or depend on GPAC libraries should be inventoried and assessed for exposure.

Exploitability

Exploitability is high in practice. The vulnerability requires only network access and a crafted MP4 file—no authentication, privileges, or user interaction. Proof-of-concept creation is straightforward for someone familiar with MP4 file structure. However, this is not yet listed on CISA's Known Exploited Vulnerabilities catalog, suggesting active weaponization has not been publicly confirmed as of the publication date. Automated scanning for vulnerable MP4Box instances is possible but not trivial without direct service exposure detection.

Remediation

Upgrade GPAC to a patched version released after this vulnerability's disclosure. Contact the GPAC project for patch availability and timeline. As an interim measure, restrict network exposure of MP4Box services, implement input validation on MP4 files (reject oversized or malformed files), and place MP4Box instances behind web application firewalls or rate limiters. Monitor process crashes and segment media processing infrastructure to limit blast radius.

Patch guidance

Check the GPAC project repository and release notes for a version newer than v2.4 that addresses CWE-121 in in_file.c. Verify patch availability by examining commit history or security advisories on the official GPAC website. Test patched versions in a staging environment with both legitimate and malformed MP4 files before production deployment. If the vendor has not released a patch, consider implementing a sandboxed execution environment or alternative MP4 processing tool as a workaround.

Detection guidance

Monitor for MP4Box process crashes correlated with unusual or oversized MP4 file submissions. Log file sizes and submission patterns to the service. Implement network-based detection by inspecting MP4 file headers for anomalies (malformed atom sizes, invalid nesting). Endpoint detection and response (EDR) tools can flag repeated process crashes in media processing pipelines. Security Information and Event Management (SIEM) systems should correlate MP4 ingestion failures with potential attack patterns.

Why prioritize this

This vulnerability warrants prompt attention for organizations using MP4Box in production pipelines. The CVSS score of 7.5 reflects high severity due to unrestricted network access and certain availability impact. Although not yet publicly exploited, the straightforward attack vector (crafted file) and ease of reproduction elevate risk. Prioritize patching if MP4Box is internet-facing or processes untrusted media; deprioritize if it is isolated and processes only internal, validated content.

Risk score, explained

The CVSS 3.1 score of 7.5 (High) reflects a network-accessible denial-of-service flaw with no authentication or user interaction required. The vector AV:N/AC:L/PR:N/UI:N indicates network exploitability and low complexity. The A:H component denotes high impact to availability (process crash). The absence of confidentiality (C:N) and integrity (I:N) impact caps the score below critical range. Real-world risk depends on deployment context: services directly exposed to untrusted input face higher practical risk than isolated instances.

Frequently asked questions