CVE-2025-55663: MP4Box Segmentation Fault DoS Vulnerability – GPAC v2.4

Technical summary

CVE-2025-55663 is a null pointer dereference (CWE-476) in the Track_SetStreamDescriptor function within isomedia/track.c of GPAC MP4Box v2.4. The vulnerability is triggered when the application parses a malformed MP4 container with crafted stream descriptor metadata. The segmentation violation occurs because the code does not validate or safely handle missing or invalid descriptor pointers before dereferencing them. The attack surface is local; exploitation requires user interaction to open or process a malicious file. No remote code execution, privilege escalation, or confidentiality breach is possible—the sole impact is availability.

Business impact

Organizations deploying MP4Box in automated media workflows (transcoding, analysis, archival systems) face potential service interruptions if an attacker can inject malicious MP4 files into processing queues. Security teams, content analysis platforms, and broadcast infrastructure that rely on GPAC for format validation or conversion are at risk. The impact is limited to availability, making this a moderate concern rather than critical, but repeated crashes could degrade service reliability and require incident response overhead.

Affected systems

GPAC MP4Box version 2.4 is affected. The vulnerability exists in the isomedia/track.c module responsible for parsing MP4 track descriptors. Any system running MP4Box v2.4 that processes untrusted or user-supplied MP4 files is at risk. Verify against the vendor advisory whether earlier versions (such as 2.3 or earlier) or later patched versions (2.4.1 or beyond) are affected or mitigated; this CVE record identifies v2.4 as the known vulnerable release.

Exploitability

Exploitation requires local file access and user or application interaction to process the malicious MP4 file. There is no network attack vector, no authentication bypass, and no privilege requirement. An attacker must deliver a crafted MP4 file and have it opened or parsed by MP4Box—via email, file sharing, a web upload form, or an automated import pipeline. The technical bar to craft such a file is low, but the requirement for user action keeps the CVSS base score at 5.5 (MEDIUM). This is not an in-the-wild threat at this time, as the KEV (Known Exploited Vulnerabilities) catalog does not list it.

Remediation

Upgrade GPAC MP4Box to a patched version released after v2.4. Consult the official GPAC releases and security advisories to confirm the minimum safe version. Until patching is complete, implement input validation controls: sanitize or scan MP4 files before processing with MP4Box, restrict file uploads to trusted sources, and consider sandboxing the media processing environment to limit crash blast radius. Disable or isolate MP4Box if it is not essential to your workflow.

Patch guidance

Contact GPAC project maintainers or check their official repository (gpac.github.io or similar) for a patched release addressing CVE-2025-55663. The vulnerability is in v2.4; verify the exact patch version (e.g., v2.4.1 or later) from official release notes or security advisories. Test patches in a non-production environment against your media processing workloads to confirm stability and compatibility before broad deployment. If you are using GPAC as a dependency in another application, check that application's vendor for a patched version incorporating the updated GPAC library.

Detection guidance

Monitor for unexpected crashes or segmentation faults in MP4Box processes, particularly those handling external or user-supplied MP4 files. Log and alert on application restarts or core dumps from the isomedia/track.c module. At the host level, watch for repeated ProcessExitCode errors or segmentation fault signals from MP4Box. In automated workflows, track job failures tied to specific MP4 file types or sources; a sudden uptick in 'invalid track descriptor' errors may signal an attack. Network-level detection is not applicable; focus on host and application logs.

Why prioritize this

This vulnerability merits prompt but not emergency attention. It is a MEDIUM-severity availability issue with no remote attack vector, no privilege escalation, and no data exposure. However, if your organization operates media processing infrastructure, transcoding pipelines, or content analysis systems that rely on MP4Box, availability disruptions can cascade into SLA violations and customer impact. Prioritize patching if MP4Box processes untrusted media; deprioritize if it is only used internally on controlled content. The lack of KEV listing indicates no active exploitation in the wild, so you have time to plan and test patches methodically.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: (1) Local attack vector—no remote exploitation; (2) Low complexity and no special privileges required—any user can trigger it by opening a file; (3) User interaction required—a victim must open the malicious MP4; (4) High impact on availability—the application crashes; (5) No confidentiality or integrity impact. The MEDIUM severity is appropriate for a robust but non-critical availability issue. Organizations with resilient, multi-instance media processing should view this as lower risk; those reliant on single-threaded or non-recoverable MP4Box instances should treat it with more urgency.

Frequently asked questions