https://seclists.org/oss-sec/2026/q4/216: CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
Published Oct 17, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box
GPAC versions prior to commit 321624f28d19a413449fd1718d1eb59037f8f7fc are affected. The issue was reproducible on the current master branch at the time of discovery.
An attacker must provide a crafted MP4 file with manipulated sample metadata, such as corrupted sample counts, invalid aspect ratios, or oversized box declarations. The vulnerable code path is reached when MP4Box imports the crafted track.
No authentication or special privileges are required. Exploitation requires a user to process or import the attacker-supplied MP4 file.
The reported CVSS 3.1 vector is 8.8 High, with high confidentiality, integrity, and availability impact. The immediate observed result is a heap buffer overflow caused by writing beyond the allocated sample-size table buffer.