CVE-2025-55643: GPAC MP4Box NULL Pointer DoS Vulnerability

Technical summary

The vulnerability exists in filters/mux_isom.c, the ISOM (ISO Base Media File Format) multiplexing module of GPAC. When MP4Box processes a crafted MP4 file, a code path in the TrackWriter handling logic fails to validate or check for a NULL pointer before dereferencing it. This classic NULL pointer dereference (CWE-476) results in an unhandled exception that crashes the process. The flaw does not permit code execution, privilege escalation, or data exfiltration—it purely denies availability of the MP4Box tool for the affected user.

Business impact

MP4Box is commonly used in media processing pipelines, automated transcoding workflows, and video analysis tools. A successful exploit disrupts these operations by crashing the process, potentially halting batch jobs or causing manual reprocessing of files. For organizations relying on MP4Box in CI/CD or content delivery chains, this can lead to service delays and operational friction. The impact is narrowly scoped to availability; no data confidentiality or integrity risk exists. However, if MP4Box is part of a critical media ingest or validation pipeline, unexpected crashes can trigger incident response overhead and reputational impact if user-facing services are affected.

Affected systems

GPAC MP4Box v2.4 is confirmed vulnerable. Organizations should verify whether they use GPAC in any capacity—including as a library in larger applications, in Docker containers, in media processing servers, or in development toolchains. The vulnerability is local and requires a user or automated process to open a malicious MP4 file, so it primarily affects systems that accept untrusted MP4 input or expose MP4Box to external file sources.

Exploitability

Exploitability is low in practice, though technically straightforward. An attacker must craft a specific MP4 file that triggers the NULL pointer dereference and deliver it to a target who will open it with MP4Box. There is no remote exploitation vector, no privilege escalation, and no means to trigger the flaw passively. The attack requires user interaction or automated processing of attacker-controlled files. Since the vector is local and UI-dependent (CVSS AV:L, UI:R), real-world exploitation relies on social engineering or access to a system that processes untrusted media files.

Remediation

Upgrade GPAC to a patched version released after June 2026 (verify against the official GPAC project repository and advisories for the exact version). In the interim, apply input validation and sandboxing measures: reject or isolate MP4 files from untrusted sources, run MP4Box in a restricted environment (containers, virtual machines, or user accounts with minimal privileges), and monitor for unexpected process terminations. If MP4Box is embedded in a larger application, check for library updates from the vendor providing that application.

Patch guidance

Contact the GPAC project maintainers or consult the official GPAC repository (https://github.com/gpac/gpac) for the patched release. The vulnerability was published on 2026-06-15; patches are expected to be available shortly after. Apply patches to all systems running MP4Box v2.4, including containerized deployments and development machines. Verify the patched version resolves the issue by testing with the crafted MP4 file samples (if available from the vendor) in a non-production environment.

Detection guidance

Monitor system logs for unexpected crashes or segmentation faults in MP4Box processes, particularly when correlating with MP4 file ingestion events. Implement file-type validation and integrity checks before MP4Box processes input (e.g., validate MP4 headers with tools like MediaInfo). In automated workflows, add process exit-code monitoring and alerting. Intrusion detection signatures specific to this CVE will emerge after patch release; subscribe to vendor security advisories and CISA alerts for detection patterns.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.5), this vulnerability should be addressed in the normal maintenance cycle rather than emergency response. It carries no data breach or privilege escalation risk, and real-world exploitation requires user interaction or control over file inputs. However, if your organization heavily relies on MP4Box in automated or user-facing workflows, prioritize patching to avoid operational disruptions. If MP4Box is only used ad-hoc by technical staff in isolated environments, risk is minimal.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects the limited scope of impact: availability is affected (high impact on that metric), but confidentiality and integrity are not. The attack vector is local (AV:L), attack complexity is low (AC:L), no privileges are required (PR:N), and user interaction is necessary (UI:R). The absence of a scope change (S:U) limits the severity. This is a classic availability-only DoS that ranks below HIGH or CRITICAL thresholds because it neither compromises data nor allows privilege escalation.

Frequently asked questions