CVE-2025-55649: NULL Pointer Defence in GPAC/MP4Box via gf_media_map_esd on crafted MP4 with corrupted ESD data
A NULL pointer dereference in the gfmediamapesd function (mediatools/isomtools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall or stop using GPAC MP4Box v2.4 on any systems that process untrusted MP4 files until a vendor patch or fixed version is made available.
- Compensating control
Prevent ingestion/processing of untrusted or unauthenticated MP4 files. Restrict upload/processing endpoints to trusted IPs, enforce strict file type validation, scan MP4 files for corruption/malformation before processing, and handle MP4 processing in isolated/sandboxed environments (e.g., containers or VMs) to limit impact of a crash/DoS.
- Operational
Monitor systems that run MP4Box for crashes or hangs (signs of DoS). Collect logs and crash dumps for any events triggered by MP4 processing and avoid processing suspicious files until a fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55649?
CVE-2025-55649 has a medium severity rating of 5.5 as per the CVSS 3.1 score.
What software is affected by CVE-2025-55649?
CVE-2025-55649 affects GPAC MP4Box version 2.4.
How do I fix CVE-2025-55649?
To fix CVE-2025-55649, update GPAC MP4Box to the latest version released after the vulnerability was disclosed.
What type of attack is possible due to CVE-2025-55649?
CVE-2025-55649 allows attackers to exploit the vulnerability to cause a Denial of Service (DoS).
What vulnerability type is CVE-2025-55649 classified as?
CVE-2025-55649 is classified as a Null Pointer Dereference vulnerability.