https://seclists.org/oss-sec/2026/q4/216: CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
Affected Software
Frequently Asked Questions
Which GPAC versions are affected?
GPAC versions prior to commit 321624f28d19a413449fd1718d1eb59037f8f7fc are affected. The issue was reproducible on the current master branch at the time of discovery.
What must an attacker do to trigger the flaw?
An attacker must provide a crafted MP4 file with manipulated sample metadata, such as corrupted sample counts, invalid aspect ratios, or oversized box declarations. The vulnerable code path is reached when MP4Box imports the crafted track.
Does exploitation require authentication or elevated privileges?
No authentication or special privileges are required. Exploitation requires a user to process or import the attacker-supplied MP4 file.
What is the potential security impact?
The reported CVSS 3.1 vector is 8.8 High, with high confidentiality, integrity, and availability impact. The immediate observed result is a heap buffer overflow caused by writing beyond the allocated sample-size table buffer.