CVE-2025-55641: NULL Pointer Dereference in GPAC MP4Box v2.4 Denial of Service

Technical summary

CVE-2025-55641 is a NULL pointer dereference vulnerability located in the gf_isom_copy_sample_info function within the isomedia/isom_write.c source file of GPAC MP4Box v2.4. The vulnerability stems from insufficient validation of MP4 file structures during sample information processing. When MP4Box attempts to copy sample data from a crafted MP4 file lacking required structural elements, the function dereferences a NULL pointer, triggering an unhandled exception. The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and carries a CVSS v3.1 score of 5.5 (MEDIUM severity) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating local attack vector, low attack complexity, no privilege requirement, user interaction required, no confidentiality impact, no integrity impact, and high availability impact.

Business impact

Organizations and individuals relying on MP4Box for media processing workflows face service disruption when processing untrusted MP4 files. While the vulnerability does not enable data theft or modification, it can interrupt batch processing operations, automated transcoding pipelines, or media analysis tools that depend on MP4Box. For security teams using MP4Box in malware analysis or digital forensics workflows, crafted samples could halt investigations or analysis chains. The practical impact remains contained to availability; however, repeated denial-of-service incidents could degrade operational resilience.

Affected systems

GPAC MP4Box v2.4 is the confirmed affected version. Organizations running this version—particularly those using it in command-line batch operations, CI/CD pipelines, or media-handling infrastructure—should assess exposure. The vulnerability requires local file system access and user or process interaction to trigger, limiting exposure in fully automated, network-isolated deployments. Legacy installations or development environments with direct MP4Box usage face higher risk.

Exploitability

This vulnerability has a moderate barrier to exploitation. An attacker must craft a malicious MP4 file and deliver it to a user or process that will open it in MP4Box. Attack surface is primarily social engineering (convincing a user to process a suspicious file) or compromised content sources. The vulnerability does not enable remote code execution or privilege escalation; it only denies service. Exploit complexity is low once a crafted file is prepared, but the requirement for user interaction significantly reduces real-world attack likelihood compared to remotely exploitable flaws. No public exploit code or proof-of-concept has been designated as widely available (KEV status is negative).

Remediation

Apply a patched version of GPAC MP4Box released after v2.4. Consult the GPAC project's official advisories and release notes to identify the first fixed version. Until patching is feasible, implement input validation and sandboxing: restrict MP4Box processing to trusted, validated sources and run it in isolated containers or restricted user accounts. Monitor for abnormal termination or repeated crashes when processing media files, which may indicate exploitation attempts. Consider temporarily disabling automatic MP4 processing from untrusted channels.

Patch guidance

Update GPAC MP4Box to a version newer than v2.4 that includes the fix for gf_isom_copy_sample_info NULL pointer dereference. Verify the patch version against the official GPAC project releases and security advisories at the GPAC GitHub repository or primary vendor channels. Test patched versions in non-production environments before deployment to ensure compatibility with existing workflows. If an in-place upgrade is not immediately feasible, isolate systems running v2.4 from untrusted input sources.

Detection guidance

Monitor for MP4Box process crashes or abnormal terminations, particularly when processing files from external or untrusted sources. Log file processing activities and correlate sudden process exits with specific MP4 files to identify potential exploitation. In containerized or sandboxed environments, monitor for unexpected resource exhaustion or container termination tied to media processing tasks. Network-based detection is limited since exploitation is local; focus on endpoint-level process monitoring and file integrity checks. Alert on repeated access to MP4 files followed by service disruption within media processing pipelines.

Why prioritize this

While the CVSS score of 5.5 (MEDIUM) reflects the availability-only impact and local attack vector, prioritization depends on your reliance on MP4Box in critical workflows. Organizations with automated, network-facing media processing (e.g., cloud-based transcoding, user-uploaded content handling) should treat this as elevated priority to prevent service disruption. Those using MP4Box only in isolated development or testing environments can defer patching to standard maintenance windows. The lack of KEV designation and the requirement for user interaction lower urgency for many enterprise environments, but media-heavy organizations should address it within 30–60 days.

Risk score, explained

The MEDIUM severity reflects the absence of confidentiality or integrity impact, combined with the local-attack-vector requirement and need for user interaction. The high availability impact (crash/DoS) justifies the 5.5 score. However, real-world risk varies by context: in mission-critical, user-facing media platforms, this represents higher operational risk; in isolated development use, it is lower. Adjust your internal prioritization based on MP4Box's role in your architecture and exposure to untrusted files.

Frequently asked questions