CVE-2025-55649: GPAC MP4Box NULL Pointer DoS Vulnerability

Technical summary

The vulnerability exists in the gf_media_map_esd function within media_tools/isom_tools.c of GPAC MP4Box v2.4. The function fails to validate a pointer before dereferencing it, leading to a NULL pointer dereference (CWE-476). When an attacker provides a crafted MP4 file with specific structural anomalies, the parsing logic reaches an unguarded dereference operation, causing an unhandled exception and process termination. The vulnerability does not permit arbitrary code execution, information disclosure, or privilege escalation—its impact is strictly availability.

Business impact

Organizations using MP4Box as part of media transcoding pipelines, content validation workflows, or batch processing automation face service interruption risk. If MP4Box operates in an automated queue or continuous integration environment, a single malicious file can halt downstream operations. The impact is moderate because exploitation requires the user to actively open a file, and recovery is straightforward (restart the application). However, in unattended or high-throughput scenarios, repeated exploitation could degrade service availability.

Affected systems

GPAC MP4Box v2.4 is the confirmed affected version. MP4Box is a command-line utility and library used for MP4 file inspection, editing, and conversion. It is commonly integrated into media processing platforms, video hosting services, and content delivery workflows. Users of GPAC v2.4 that explicitly use or expose the media_tools/isom_tools functionality are at risk. Earlier or later versions have not been confirmed as affected by this specific vulnerability and should be verified against vendor advisories.

Exploitability

Exploitability is straightforward but limited in scope. An attacker must craft a malformed MP4 file and convince or trick a user into opening it with MP4Box. This is a local attack vector with no network propagation; the attacker cannot trigger it remotely. No special conditions, race conditions, or timing issues are required. The barrier to weaponization is low—creating a malformed MP4 is trivial—but the attack surface is constrained by the requirement for user interaction and local file access. This is not an active zero-day with known public exploits.

Remediation

Apply the latest version of GPAC that includes a patch for CVE-2025-55649. Verify the patch version against official GPAC release notes and security advisories. In the interim, restrict file sources to trusted origins, implement file type validation at ingress points, and monitor for unexpected MP4Box crashes in logs. If MP4Box is exposed via web upload or API, add pre-parsing validation to reject structurally anomalous MP4 files before they reach the vulnerable function.

Patch guidance

Check the official GPAC project repository and security advisory channels for a patched version number. Apply updates to all systems running MP4Box v2.4. If you maintain a containerized or embedded deployment, rebuild and redeploy with the patched version. Test the patched version against your existing media processing workflows to ensure no regression. Document the patch date and version in your change management system.

Detection guidance

Monitor application logs and system event logs for MP4Box crashes or segmentation faults, particularly when processing files from untrusted sources. If possible, run MP4Box in a controlled sandbox or container with resource limits and crash reporting enabled. Implement file scanning rules that flag MP4 files with unusual ISOM box structures or missing mandatory atoms as lower-priority alerts. Network-based detection is not applicable for local attacks; focus on endpoint-level process monitoring and log aggregation.

Why prioritize this

This vulnerability merits medium priority patching within normal security update cycles. While the CVSS score is 5.5 (MEDIUM) and exploitation requires user interaction, the low complexity and direct availability impact mean it should not be deferred indefinitely. Prioritize patching in environments where MP4Box processes files from public or semi-trusted sources (e.g., user uploads, third-party feeds). Organizations using MP4Box solely for internal media inspection of previously validated content may defer patching with lower risk, provided they monitor for abuse.

Risk score, explained

CVSS 3.1 score of 5.5 reflects a vulnerability with local attack vector, low attack complexity, no privilege requirement, and user interaction, combined with high availability impact. No confidentiality or integrity impact moderates the severity. The score does not account for business context—organizations with high-availability media pipelines or high user-file-upload volumes should treat the effective risk as elevated relative to the numerical score.

Frequently asked questions