CVE-2025-55652: Heap-based Buffer Overflow in GPAC/MP4Box via gf_isom_vp_config_new on crafted MP4 with malformed VP codec configuration
Published Jun 13, 2026
·Updated
A heap buffer overflow in the gfisomvpconfignew function (isomedia/avcext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
2 affected components
Gpac MP4Box=2.4
Gpac GPAC<26.02.0
Event History
Jun 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·08:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-55652?
CVE-2025-55652 has a medium severity rating of 5.5 according to CVSS 3.1.
2
What type of vulnerability is CVE-2025-55652?
CVE-2025-55652 is a heap-based buffer overflow vulnerability in GPAC/MP4Box.
3
How do I fix CVE-2025-55652?
To fix CVE-2025-55652, update GPAC MP4Box to the latest version that addresses this vulnerability.
4
What can attackers achieve with CVE-2025-55652?
Attackers can cause a Denial of Service (DoS) by exploiting CVE-2025-55652 through crafted MP4 files.
5
Which function in GPAC is affected by CVE-2025-55652?
CVE-2025-55652 affects the gf_isom_vp_config_new function within GPAC MP4Box.