CVE-2025-55639: GPAC MP4Box NULL Pointer Dereference Denial of Service

Technical summary

CVE-2025-55639 is a NULL pointer dereference vulnerability in the gf_isom_add_track_kind() function within isomedia/isom_write.c in GPAC MP4Box v2.4. When MP4Box processes a crafted MP4 file, the function fails to properly validate input before dereferencing a pointer, causing the application to crash. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) and carries a CVSS v3.1 score of 6.5 (MEDIUM severity) with a network-accessible attack vector requiring only user interaction.

Business impact

Organizations relying on GPAC MP4Box for video processing, transcoding, or validation workflows face service disruption through denial of service. This is particularly relevant for media platforms, content delivery networks, and automated video processing pipelines. While the vulnerability does not enable data theft or system compromise, sustained attacks could degrade operational availability and damage service-level commitments. Recovery requires application restart and file validation, introducing operational overhead.

Affected systems

GPAC MP4Box v2.4 is confirmed affected. Organizations running this version for media file processing, inspection, or conversion are at risk. The attack surface extends to any workflow that automatically processes MP4 files from untrusted sources—file upload portals, content management systems, and automated ingest pipelines are primary concerns. Verify your GPAC version and deployment context to assess exposure.

Exploitability

Exploitation requires crafting a malicious MP4 file and inducing a victim system to process it, necessitating user interaction or automated processing of untrusted media. No network exploit is possible; the attacker must deliver the file to the target. The barrier to entry is low—existing MP4 fuzzing tools could likely generate proof-of-concept samples. However, the impact is limited to denial of service without further impact to confidentiality or integrity. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade GPAC to a version newer than v2.4 where this flaw has been corrected. Verify the patch version against official GPAC release notes. As an interim control, restrict MP4 file processing to trusted sources and implement file validation workflows that detect and quarantine suspicious or malformed media files before they reach MP4Box. Consider sandboxing MP4Box processes to limit crash impact on broader infrastructure.

Patch guidance

Consult the official GPAC project repository and release notes to identify the minimum patched version addressing gf_isom_add_track_kind() NULL pointer handling. Apply updates through your organization's standard software update process and validate in a non-production environment first. If you deploy GPAC in containerized environments, rebuild container images with the patched version and re-deploy. For systems unable to patch immediately, implement compensating controls such as input validation or file scanning before processing.

Detection guidance

Monitor for unexpected crashes or restarts of MP4Box processes in your video processing infrastructure. Log file processing errors and correlate with recent media file uploads or ingestion. If available, enable debug logging in GPAC to capture stack traces that may indicate NULL pointer dereference. Network indicators are limited since the vulnerability is triggered by file content; focus on file-based detection by analyzing crash dumps for the gf_isom_add_track_kind() function in the call stack. Host-based intrusion detection can flag abnormal application termination patterns in automated workflows.

Why prioritize this

Although rated MEDIUM severity and not yet publicly exploited, this vulnerability should be prioritized for organizations with automated media processing workflows. The network-accessible attack vector and low barrier to exploitation mean that widespread distribution of malicious MP4s could affect numerous organizations simultaneously. Prioritize patching for any system that accepts MP4 files from external or user-supplied sources, particularly in customer-facing or public-facing services. Systems processing only internally-controlled or pre-validated media face lower risk.

Risk score, explained

The CVSS 6.5 MEDIUM score reflects a network-accessible attack vector (AV:N), low attack complexity (AC:L), and requirement for user interaction (UI:R). The vulnerability causes high availability impact (A:H) through denial of service but does not compromise confidentiality or integrity (C:N, I:N). The score appropriately captures the operational risk while acknowledging the absence of data breach potential. Organizations with critical 24/7 media processing should treat this more urgently than the base score suggests.

Frequently asked questions