CVE-2025-55647: GPAC MP4Box 2.4 Out-of-Memory Denial of Service Vulnerability

Technical summary

The vulnerability exists in the mp4_mux_cenc_insert_pssh function within filters/mux_cenc.c of GPAC MP4Box v2.4. During MP4 file multiplexing operations, the function fails to properly manage memory allocation when inserting PSSH atoms into CENC-protected content. A crafted MP4 file can trigger unbounded memory allocation or integer overflow (CWE-190), exhausting available system memory and forcing the application to terminate. The flaw is triggered through user interaction with the malicious file, typically when MP4Box attempts to repackage or analyze the input.

Business impact

Organizations using GPAC MP4Box in media processing pipelines face service disruption risk. Content delivery platforms, video encoding services, and media quality assurance workflows that accept user-uploaded or third-party MP4 files may experience sudden application crashes. If MP4Box runs as a service or in automated batch processing, attackers can cause denial of service without authentication. Recovery requires process restart and may delay transcoding, publishing, or quality verification workflows.

Affected systems

GPAC MP4Box version 2.4 is affected. The vulnerability is triggered through file input, so any deployment that processes MP4 files is at risk—particularly those handling untrusted media sources (user uploads, streaming content, archival feeds). The attack vector is local and requires user or automated system interaction with the crafted file.

Exploitability

Exploitation requires crafting a malicious MP4 file and delivering it for processing. No authentication, network access, or user privileges are needed; the attacker simply provides a file. Ease of exploitation is moderate: while creating a valid but malformed MP4 with precise CENC structures requires some technical knowledge, the barrier is not exceptionally high for motivated attackers. The impact is limited to denial of service; no code execution or data compromise results.

Remediation

Upgrade GPAC MP4Box to a version after 2.4 that includes fixes for the mp4_mux_cenc_insert_pssh function. Consult the official GPAC release notes to verify the patched version. Until patching is possible, restrict MP4Box file input to trusted sources and implement file validation or sandboxing to prevent untrusted content from reaching the vulnerable code path.

Patch guidance

Verify the latest stable release of GPAC beyond version 2.4 against the official GPAC project repository or release documentation. Apply the update following your software change management process. Test the patched version in a non-production environment with sample MP4 files to confirm stability before full deployment. If you manage a media processing pipeline, coordinate the upgrade with content operations teams to minimize service disruption.

Detection guidance

Monitor MP4Box process execution for unexpected terminations or memory exhaustion events. Track system memory usage spikes during MP4 file processing; sudden out-of-memory kills may signal exploitation. Log file inputs submitted to MP4Box and cross-reference with any service interruptions. In network-facing scenarios, monitor for repeated submission of unusual or identical MP4 files that could indicate fuzzing or attack attempts. Enable verbose logging in GPAC if available to capture detailed processing errors.

Why prioritize this

This vulnerability rates MEDIUM severity with a CVSS score of 5.5. While it enables denial of service, it does not result in data theft, system compromise, or code execution. Prioritization should be based on deployment context: organizations with user-facing media services or high-volume automated processing should patch sooner; those with internal, controlled MP4 usage can defer. The lack of CISA KEV listing indicates it is not yet observed in active exploitation, allowing time for deliberate remediation planning.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, low attack complexity, no privileges required, user interaction required, and high availability impact with no confidentiality or integrity impact. The absence of network-based exploitation and the requirement for user interaction to process the file lower the score, but the guaranteed denial of service consequence justifies the MEDIUM rating.

Frequently asked questions