CVE-2025-55654: Use After Free
A use-after-free in the gffilterpidgetpacket function (filtercore/filterpid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that process attacker-supplied files with GPAC MP4Box v2.4 are exposed to denial of service. The available data does not identify a network-facing service or any affected configuration beyond processing a crafted file.
What does an attacker need to exploit it?
An attacker needs to supply a crafted file that is processed by MP4Box. The reported impact is denial of service through a use-after-free in gf_filter_pid_get_packet.
What can be done if patching is not immediately possible?
Do not process untrusted or attacker-supplied files with the affected MP4Box v2.4 deployment until a fix can be applied. The provided information does not describe another workaround or mitigation.