CVE-2025-55657: NULL Pointer Defence in GPAC/MP4Box via gf_odf_vvc_cfg_write_bs on crafted MP4 file with unsupported vvc16 box
A NULL pointer dereference in the gfodfvvccfgwritebs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall GPAC MP4Box v2.4 if the component is not required to eliminate exposure to the NULL pointer dereference triggered by crafted MP4 files.
- Compensating control
Avoid processing untrusted or unauthenticated MP4 files (particularly files containing vvc16 boxes). Restrict MP4 ingestion to trusted sources and validate file contents before handing them to MP4Box.
- Compensating control
Run MP4Box in a contained environment (sandbox, container, or restricted user account) and apply resource limits to contain crashes and limit the impact of a DoS caused by crafted MP4 files.
- Operational
If MP4Box processes a crafted file and crashes or causes service disruption, remove the offending file, restart the affected service/process, and review logs to identify affected instances and scope of impact.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55657?
CVE-2025-55657 has a severity rating of high at 7.5 according to the CVSS 3.1 scoring system.
How does CVE-2025-55657 affect Gpac MP4Box?
CVE-2025-55657 allows attackers to exploit a NULL pointer dereference, resulting in a Denial of Service (DoS) when processing a crafted MP4 file.
What versions of Gpac MP4Box are affected by CVE-2025-55657?
CVE-2025-55657 affects Gpac MP4Box version 2.4.
How can one mitigate the risks associated with CVE-2025-55657?
To mitigate the risks of CVE-2025-55657, users should avoid using vulnerable versions of Gpac MP4Box and update to patched versions as they become available.
What can happen if CVE-2025-55657 is exploited?
Exploitation of CVE-2025-55657 can lead to Denial of Service (DoS), causing the software to crash or become unresponsive.