CVE-2025-55659: GPAC MP4Box NULL Pointer Denial of Service

Technical summary

CVE-2025-55659 is a NULL pointer dereference vulnerability in the ctts_box_write function located in isomedia/box_code_base.c within GPAC MP4Box v2.4. The ctts_box_write function handles the composition-to-decode time-to-sample box during MP4 file processing. When a crafted MP4 file is supplied, the function attempts to dereference a NULL pointer, triggering an unhandled exception. The flaw is classified under CWE-476 (NULL Pointer Dereference), a common memory safety issue that occurs when code fails to validate pointer validity before use.

Business impact

Organizations relying on GPAC MP4Box for automated video transcoding, media ingest pipelines, or broadcast workflows may experience service interruptions if users or systems process attacker-controlled MP4 files. Repeated exploitation could disrupt media processing operations, delay content delivery, or require manual intervention to restart crashed services. The absence of data breach or corruption risk limits financial impact to availability loss and operational overhead.

Affected systems

GPAC MP4Box v2.4 is the confirmed affected version. Organizations using this software for media processing, video encoding, content distribution preparation, or broadcast infrastructure should prioritize inventory and testing. Verify your deployed version against GPAC's official release history and advisory documentation.

Exploitability

Exploitation requires user or system interaction: either a user must open a malicious MP4 file in an application using GPAC MP4Box, or an automated media processing pipeline must ingest untrusted content. Network accessibility is present (the file can be distributed remotely), no special privileges are required, and the attack complexity is low. However, the reliance on user action (UI:R in the CVSS vector) prevents this from being remotely exploitable in fire-and-forget scenarios. The threat is moderate for environments accepting user-uploaded media or processing feeds from untrusted sources.

Remediation

Update GPAC MP4Box to a version containing the NULL pointer dereference fix. Verify the specific patched version against GPAC's official security advisory and release notes. If an immediate patch is unavailable, implement controls to restrict processing of MP4 files from untrusted sources, or isolate media processing infrastructure to reduce user-facing impact.

Patch guidance

Consult GPAC's official advisory and GitHub repository for the patched version that resolves CVE-2025-55659. Verify the fix is present in your target release before deployment. Test the patched version against your existing media ingest workflows to ensure compatibility with downstream encoding or transcoding processes. Once validated, deploy to all systems running MP4Box v2.4 in your environment.

Detection guidance

Monitor application crash logs and core dumps for segmentation faults or NULL pointer exceptions in GPAC-related processes, particularly within ctts_box_write or isomedia box-handling functions. Implement file validation rules to reject or sandbox MP4 files with abnormal or suspicious composition-to-decode time box structures. Network-based detection is limited; focus on endpoint and log analysis. Threat hunting should focus on media ingest systems and user-facing media processing services.

Why prioritize this

Although rated MEDIUM severity (CVSS 6.5), this vulnerability warrants timely attention because it affects automated media processing infrastructure and can disrupt business-critical workflows. Organizations operating broadcast or content delivery services should prioritize patching; those using GPAC in non-critical or isolated environments may schedule updates in the next maintenance cycle. The requirement for user interaction limits critical impact but does not eliminate operational risk.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a vulnerability with high availability impact (A:H) accessible over the network (AV:N) without authentication or privilege escalation, but requiring user interaction (UI:R) to trigger. The attack vector and lack of complexity elevate the score into the MEDIUM range; the user interaction requirement prevents a higher severity rating. No confidentiality or integrity impact is present.

Frequently asked questions