CVE-2025-55664: Heap-based Buffer Overflow in GPAC/MP4Box via m2tsdmx_send_packet on crafted MPEG-2 TS file
A heap buffer overflow in the m2tsdmxsendpacket function (filters/dmxm2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall GPAC MP4Box v2.4 from any systems where it is not required to eliminate exposure to the heap buffer overflow in m2tsdmx_send_packet.
- Compensating control
Do not process untrusted MP4 or MPEG-2 TS files with MP4Box. If processing is required, perform it in a sandboxed or isolated environment with least privileges, and validate/scan input files before feeding them to MP4Box to reduce risk of Denial of Service from crafted files.
- Operational
Monitor systems running MP4Box for crashes, high resource usage, or DoS symptoms related to m2tsdmx_send_packet; if such behavior is observed, stop the service, capture the offending file(s) for analysis, and isolate the affected host for investigation.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55664?
The severity of CVE-2025-55664 is medium, rated at 5.5 on the CVSS scale.
How do I fix CVE-2025-55664?
To mitigate CVE-2025-55664, upgrade GPAC/MP4Box to the latest version where the vulnerability is patched.
What type of vulnerability is CVE-2025-55664?
CVE-2025-55664 is categorized as a heap-based buffer overflow.
What can attackers achieve with CVE-2025-55664?
Attackers can exploit CVE-2025-55664 to cause a Denial of Service (DoS) by supplying a crafted MPEG-2 TS file.
Which function is affected by CVE-2025-55664?
The m2tsdmx_send_packet function in GPAC MP4Box is affected by CVE-2025-55664.