CVE-2025-15667
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.
Risk Assessment
This vulnerability could allow a local attacker to cause system instability or potentially execute code by exploiting the double-free memory error, posing a risk to service integrity and availability.
Recommendation
Apply the patch named f29f955f2a3b5e8e507caad3e52319f961bf37bf immediately to fix the vulnerability. It is recommended to update GPAC to the latest stable version after applying the patch.
Original NVD description (English source)
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.