CVE-2025-55643: Null Pointer Dereference
A NULL pointer dereference in the TrackWriter handling component (filters/muxisom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall GPAC MP4Box v2.4 if it is not required; replace with an alternative MP4 processing tool or a patched version when available.
- Compensating control
Do not process or accept MP4 files from untrusted sources. Restrict uploads and feeds to trusted sources, and enforce file validation or scanning before handing files to MP4Box.
- Compensating control
Run MP4Box in a restricted/sandbox or isolated environment with least privileges and enforced resource limits (CPU, memory, execution time) to limit impact of a crafted MP4 causing a DoS.
- Operational
Monitor MP4Box processes for crashes or abnormal termination and plan to apply vendor-provided fixes or upgrades as soon as fixed versions become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55643?
The severity of CVE-2025-55643 is classified as medium with a CVSS score of 5.5.
How do I fix CVE-2025-55643?
To fix CVE-2025-55643, update GPAC MP4Box to the latest version where the NULL pointer dereference vulnerability is patched.
What type of attack does CVE-2025-55643 facilitate?
CVE-2025-55643 facilitates a Denial of Service (DoS) attack through crafted MP4 files.
Which component of GPAC MP4Box is affected by CVE-2025-55643?
The TrackWriter handling component in filters/mux_isom.c of GPAC MP4Box is affected by CVE-2025-55643.
What is the potential impact of exploiting CVE-2025-55643?
Exploiting CVE-2025-55643 can lead to a Denial of Service condition, disrupting service availability.