CVE-2025-55651: GPAC MP4Box NULL Pointer Dereference DoS Vulnerability

Technical summary

The vulnerability exists in the gf_isom_get_user_data_count function within isomedia/isom_read.c of GPAC MP4Box v2.4. It is a NULL pointer dereference (CWE-476) that occurs during parsing of MP4 file structures. When the function processes a crafted MP4 file with malicious user data entries, it fails to validate a pointer before dereferencing it, causing an unhandled exception. The attack vector is local and requires minimal privileges, with the only user interaction needed being the opening of the malicious file. The CVSS 3.1 score of 5.5 (MEDIUM severity) reflects availability impact only—no confidentiality or integrity risk.

Business impact

Organizations relying on MP4Box or GPAC for media processing workflows face service disruption risk. Automated media ingest pipelines, transcoding farms, or file validation systems using this library could be halted by a single crafted file. If an attacker sends a malicious MP4 to a media processing service, legitimate work stops until the process is restarted. For security teams, this represents a potential vector for nuisance attacks or workflow sabotage rather than data theft or system compromise. The impact is limited to availability.

Affected systems

GPAC MP4Box version 2.4 is explicitly vulnerable. Organizations should identify all deployments where this version is used—including standalone tools, embedded libraries in media applications, or container-based workflows. GPAC is used across the media and streaming industry for MP4 manipulation and analysis. Check your software bill of materials (SBOM) for GPAC dependencies, especially in ingest, validation, or transcoding toolchains.

Exploitability

Exploitation is straightforward: an attacker crafts a malformed MP4 file with malicious user data structures and distributes it. When the target opens the file with MP4Box v2.4, the application crashes. The attack requires only that a user open the file—no advanced techniques, credentials, or network access needed. However, exploitation is limited to the local system where the file is opened. The barrier to entry is low, but impact is confined to denial of service on that single instance. No evidence of public exploitation (KEV status is false) is currently tracked.

Remediation

Update GPAC to a patched version that addresses the NULL pointer dereference in gf_isom_get_user_data_count. Verify the specific patch version against the GPAC project's advisory or release notes. Until patching is complete, minimize exposure by restricting which users or systems can process untrusted MP4 files, implementing file validation pre-ingestion where possible, and monitoring for unexpected application crashes in media processing pipelines.

Patch guidance

Consult the GPAC project repository and official security advisories for the patched version addressing CVE-2025-55651. Apply updates first to non-production environments to verify compatibility with your media workflows. If GPAC is embedded in third-party applications (video players, transcoding services, etc.), check those vendors' advisory pages for their own patched releases. Test that legitimate MP4 files continue to process correctly after patching.

Detection guidance

Monitor application logs and crash dumps for segmentation faults or access violations in MP4Box or GPAC processes, particularly in isomedia/isom_read.c. Alert on unexpected termination of media processing jobs. If possible, use sandboxed or containerized environments for untrusted file processing to limit blast radius. Implement file format validation before passing MP4s to GPAC—malformed files triggering crashes may indicate attack attempts. Rate-based anomalies in application crashes could signal an attacker testing malicious files.

Why prioritize this

This vulnerability merits medium priority based on CVSS 5.5 but context-dependent urgency. If your organization's media pipelines are internet-facing or process user-supplied files, prioritize patching to prevent workflow disruption. If GPAC is used only internally on controlled files, the risk is lower but still warrants scheduling. Absence from KEV catalogs suggests no active exploitation in the wild, but the low barrier to weaponization means that could change.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (requires file to be opened locally), Access Complexity Low (no special conditions), Privileges Required None, User Interaction Required (user must open file), and Availability Impact High (crash/DoS). The score is not elevated to HIGH because there is no confidentiality or integrity risk—the impact is limited to availability, and the attack requires local access and user action. Organizations processing untrusted media files should consider this higher in their queue than the base score alone suggests.

Frequently asked questions