CVE-2025-55657
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in GPAC MP4Box v2.4: NULL pointer dereference in gf_odf_vvc_cfg_write_bs function (odf/descriptors.c). An attacker can cause a Denial of Service (DoS) by supplying a crafted MP4 file.
Risk Assessment
Risk of service disruption (DoS) by sending a malicious MP4 file to applications using GPAC MP4Box.
Recommendation
Update GPAC to the latest patched version. Restrict processing of untrusted MP4 files.
Other vulnerabilities in GPAC
See all- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2026-52489Low risk· EPSS 8%
Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function.
- CVE-2026-50810Medium
A NULL pointer dereference vulnerability exists in the smooth_parse_stream_index() function in src/media_tools/mpd.c of GPAC. The issue is fixed in commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.
- CVE-2025-15668Low
A vulnerability was found in GPAC up to b40ce70f5 in the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the MP4Box component. Manipulation of the data argument leads to a heap-based buffer overflow. Local access is required and the exploit is publicly available.
- CVE-2025-15667Low
A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.
- CVE-2026-14801Low
A security vulnerability was detected in GPAC 26.03-DEV-rev342-g80071f700-master in the function txtin_probe_duration of the file src/filters/load_text.c of the TeXML File Handler component. Manipulation of the argument txml_timescale leads to a divide by zero. The attack requires local access.
Original NVD description (English source)
A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.