CVE-2025-55663: NULL Pointer Defence in GPAC/MP4Box via Track_SetStamDescriptor on crafted MP4 with unknown svcC box in av01
A segmentation violation in the TrackSetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC/MP4Box v2.4from your environment.Uninstall or stop using GPAC MP4Box v2.4 until a patched fixed version is made available.
- Compensating control
Prevent or restrict processing of untrusted MP4 files (for example: disable automatic ingestion of MP4s from untrusted sources, validate and reject files that contain unexpected/unknown boxes such as an unknown 'svcC' box in av01, and process files only in isolated/sandboxed environments).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55663?
CVE-2025-55663 has a medium severity rating of 5.5 according to CVSS 3.1.
How does CVE-2025-55663 affect GPAC/MP4Box?
CVE-2025-55663 can cause a Denial of Service (DoS) due to a segmentation violation triggered by a crafted MP4 file.
What component of GPAC is vulnerable in CVE-2025-55663?
The vulnerability affects the Track_SetStreamDescriptor function in the isomedia/track.c file of GPAC MP4Box.
How can I mitigate CVE-2025-55663?
To mitigate CVE-2025-55663, you should avoid processing untrusted or crafted MP4 files in GPAC MP4Box.
What type of vulnerability is CVE-2025-55663 classified as?
CVE-2025-55663 is classified as a Null Pointer Dereference vulnerability.