CVE-2025-55645: Heap Buffer Overflow in GPAC MP4Box v2.4 – DoS Vulnerability

Technical summary

A heap buffer overflow vulnerability exists in the gf_cenc_set_pssh function within isomedia/drm_sample.c of GPAC MP4Box v2.4. The function fails to properly validate buffer boundaries when processing PSSH (Protection System Specific Header) boxes in MP4 files, leading to out-of-bounds memory writes. The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and results in uncontrolled memory corruption that triggers a denial of service condition. The flaw does not enable code execution or information disclosure in its current form.

Business impact

Organizations using GPAC MP4Box v2.4 for video processing, transcoding, or media analysis workflows face service interruption risk. If MP4Box is deployed in automated media pipelines or content validation systems, an attacker can inject a crafted file into the workflow to cause crashes and halt processing. This is particularly relevant for media delivery platforms, broadcast automation systems, and video forensics tools that rely on GPAC for MP4 parsing. Recovery requires manual intervention and system restart, incurring operational overhead.

Affected systems

GPAC MP4Box v2.4 is affected. Organizations should identify all deployments of this version, particularly in production environments where it processes untrusted or user-supplied media files. Check for GPAC usage in video transcoding pipelines, content management systems, digital asset management platforms, and security tools that parse or validate MP4 containers. Verify version numbers in installed GPAC libraries and command-line tools.

Exploitability

Exploitation requires an attacker to craft a malicious MP4 file and deliver it to a user or system that will open it with GPAC MP4Box v2.4. The attack vector is local and requires user interaction (opening the file), making it unsuitable for large-scale automated attacks. However, if the affected version is integrated into an automated media processing service that accepts user uploads without validation, the barrier to exploitation is effectively lowered. The CVSS score of 5.5 reflects medium severity—impact is limited to availability, not confidentiality or integrity.

Remediation

Update GPAC to a patched version that addresses the heap buffer overflow. Verify the specific patch version against the official GPAC project advisory, as version numbering may vary by distribution and build channel. As an interim control, restrict MP4 file processing to trusted sources and implement file format validation prior to opening files with GPAC. Consider sandboxing or containerizing MP4Box execution to limit the blast radius of a crash.

Patch guidance

Contact the GPAC project or your GPAC distributor for the recommended patched version. Verify patch availability by consulting the official GPAC repository (typically github.com/gpac/gpac) and reviewing security advisories. If you distribute GPAC as part of a larger product, check with your vendor for an updated release. Test the patched version in a non-production environment against your media workflows before deployment to confirm no regression.

Detection guidance

Monitor for unexpected crashes or restarts of MP4Box processes, particularly when processing files from external sources. Log and alert on file processing errors in automated pipelines. If feasible, implement input validation to reject malformed MP4 files before they reach GPAC. Advanced detection requires review of crash logs and core dumps to identify heap corruption patterns; this is forensically intensive and should be paired with file integrity monitoring to identify suspicious uploads.

Why prioritize this

Although this vulnerability has a medium CVSS score and is not on the CISA KEV list, it merits prompt attention if GPAC MP4Box v2.4 is in use in your environment. The threat is amplified if the software processes files from untrusted sources or is part of an automated, always-on service. Prioritize based on deployment scope: high priority if widely deployed or publicly exposed; lower priority if confined to isolated development or testing use.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the following: Attack Vector is Local (AV:L) because files must be accessed from the local file system; Attack Complexity is Low (AC:L) because no special conditions are required to trigger the overflow; Privileges are not required (PR:N); User Interaction is required (UI:R) because a user must open the file; Scope is Unchanged (S:U); Confidentiality impact is None (C:N); Integrity impact is None (I:N); Availability impact is High (A:H) because the overflow causes a crash. The lack of remote exploitability and code execution capability keeps the score in the medium range despite the guaranteed denial of service.

Frequently asked questions