CVE-2025-55652: Heap-based Buffer Overflow in GPAC/MP4Box via gf_isom_vp_config_new on crafted MP4 with malformed VP codec configuration
A heap buffer overflow in the gfisomvpconfignew function (isomedia/avcext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC/MP4Boxfrom your environment.Uninstall or stop using GPAC MP4Box v2.4 (the affected component) until a security patch or fixed version is made available.
- Compensating control
Avoid processing untrusted MP4 files with GPAC MP4Box; if MP4 processing is required, run MP4Box in a sandboxed or isolated environment (e.g., container, VM) and restrict access to MP4 ingestion interfaces to trusted sources to mitigate potential DoS from crafted files.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55652?
CVE-2025-55652 has a medium severity rating of 5.5 according to CVSS 3.1.
What type of vulnerability is CVE-2025-55652?
CVE-2025-55652 is a heap-based buffer overflow vulnerability in GPAC/MP4Box.
How do I fix CVE-2025-55652?
To fix CVE-2025-55652, update GPAC MP4Box to the latest version that addresses this vulnerability.
What can attackers achieve with CVE-2025-55652?
Attackers can cause a Denial of Service (DoS) by exploiting CVE-2025-55652 through crafted MP4 files.
Which function in GPAC is affected by CVE-2025-55652?
CVE-2025-55652 affects the gf_isom_vp_config_new function within GPAC MP4Box.