CVE-2025-55659: NULL Pointer Defence in GPAC/MP4Box via ctts_box_write on crafted MP4 file with negative timestamps

Published Jun 9, 2026

Updated

A NULL pointer dereference in the cttsboxwrite function (isomedia/boxcodebase.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Affected Software

2 affected components

Gpac MP4Box=2.4

Gpac GPAC=2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove GPAC MP4Box v2.4 from your environment.
Uninstall GPAC MP4Box v2.4 or stop using it if it is not required.
Compensating control
Do not process untrusted or unverified MP4 files. If MP4 parsing is required, sandbox MP4Box (isolate in a container or VM), enforce strict resource limits and timeouts on parsing operations, and restrict file upload/processing endpoints to trusted users or networks to mitigate potential DoS from crafted files.

Event History

Jun 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-55659?

The severity of CVE-2025-55659 is classified as medium with a CVSS score of 6.5.

How do I fix CVE-2025-55659?

To fix CVE-2025-55659, update to the latest version of GPAC MP4Box that addresses the NULL pointer dereference issue.

What type of vulnerability is CVE-2025-55659?

CVE-2025-55659 is a NULL pointer dereference vulnerability that can lead to a Denial of Service (DoS).

What can an attacker do with CVE-2025-55659?

An attacker can exploit CVE-2025-55659 by supplying a crafted MP4 file, resulting in a Denial of Service.

In which function is CVE-2025-55659 found?

CVE-2025-55659 is found in the ctts_box_write function within the file isomedia/box_code_base.c of GPAC MP4Box.