CVE-2025-55664
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A heap buffer overflow in the m2tsdmx_send_packet function of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
Risk Assessment
The risk is that an attacker can crash the application, potentially disrupting services that process MP4 files.
Recommendation
Update GPAC MP4Box to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in GPAC MP4Box
See all- CVE-2025-60465Medium
A use-after-free vulnerability was found in the gf_filter_pid_inst_swap function of GPAC/MP4Box before version 26.02.0. An attacker can supply a crafted media file to cause a Denial of Service (DoS).
- CVE-2025-60464High
A use-after-free vulnerability was found in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted MPEG-2 TS file.
- CVE-2025-60473Medium
A NULL pointer dereference vulnerability was found in the gf_filter_in_parent_chain function of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted file.
- CVE-2025-60466Medium
A use-after-free vulnerability was found in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC/MP4Box before version 26.02.0. Attackers can cause a Denial of Service (DoS) by supplying a crafted media file.
- CVE-2025-60474High
A buffer overflow vulnerability in the gf_media_import function of GPAC/MP4Box before version 26.02.0 allows an attacker to cause a Denial of Service (DoS) by supplying a crafted input file.
- CVE-2025-55639Medium
A NULL pointer dereference vulnerability was discovered in GPAC MP4Box v2.4 in the gf_isom_add_track_kind() function at isomedia/isom_write.c. Attackers can exploit this by crafting a malicious MP4 file to cause a Denial of Service (DoS).
- CVE-2025-55663Medium
A segmentation violation in the Track_SetStreamDescriptor function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
- CVE-2025-55661Medium
A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- CVE-2025-55660Medium
A stack overflow in the gf_opus_read_length function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
- CVE-2025-55652Medium
A heap buffer overflow in the gf_isom_vp_config_new function in GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
Original NVD description (English source)
A heap buffer overflow in the m2tsdmx_send_packet function (filters/dmx_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.