CVE-2025-15667: GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the component MP4Box. This manipulation of the argument naluoutbs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (src/isomedia/avc_ext.c gf_isom_nalu_sample_rewrite)to a version that resolves this vulnerability.Fixed in 2.5-DEVPatch f29f955f2a3b5e8e507caad3e52319f961bf37bf - Operational
Deploy the provided patch (Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf) to address the double free caused by manipulation of the nalu_out_bs argument in gf_isom_nalu_sample_rewrite (src/isomedia/avc_ext.c) for MP4Box.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15667?
The severity of CVE-2025-15667 is rated low with a score of 3.3.
How do I fix CVE-2025-15667?
To fix CVE-2025-15667, update to the latest version of GPAC that resolves the double free vulnerability.
What components are affected by CVE-2025-15667?
CVE-2025-15667 affects the MP4Box component of GPAC, specifically the function gf_isom_nalu_sample_rewrite.
What type of vulnerability is CVE-2025-15667?
CVE-2025-15667 is a double free vulnerability caused by the manipulation of the nalu_out_bs argument.
Can CVE-2025-15667 be exploited remotely?
CVE-2025-15667 requires local host access to exploit, as it affects a local function in GPAC.