CVE-2025-55641: NULL Pointer Defence in GPAC/MP4Box via gf_isom_copy_sample_info on crafted MP4 file with corrupted SAI metadata
A NULL pointer dereference in the gfisomcopysampleinfo function (isomedia/isomwrite.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall or remove GPAC MP4Box v2.4 from systems until a patched/fixed version is available.
- Compensating control
Avoid processing or accepting MP4 files from untrusted sources. If MP4 files must be processed, run MP4Box in a sandboxed/restricted environment or isolate the processing service to mitigate Denial of Service caused by crafted MP4 files.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55641?
CVE-2025-55641 has a severity rating of medium with a CVSS score of 5.5.
How do I fix CVE-2025-55641?
To fix CVE-2025-55641, update GPAC MP4Box to the latest version that addresses this vulnerability.
What type of attack is facilitated by CVE-2025-55641?
CVE-2025-55641 allows attackers to perform a Denial of Service (DoS) attack via a crafted MP4 file.
What is the impact of CVE-2025-55641 on GPAC MP4Box?
The impact of CVE-2025-55641 is a potential crash or unresponsive state of the GPAC MP4Box application.
Which function is affected by CVE-2025-55641?
CVE-2025-55641 affects the gf_isom_copy_sample_info function in the isomedia/isom_write.c file.