Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 78c2c9be29a41b38eca2c53d280442088a71dab9 CVE: CVE-2025-55639 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfisomaddtrackkind() function in GPAC's ISO media muxer (isomedia/isomwrite.c:3153) appends a track "kind" metadata entry to an MP4 track during mux setup. When MP4Box imports a crafted MP4 file containing corrupted MPEG-2 TS PMT descriptors and an MPEG-H Audio track with missing or empty kind metadata, mp4muxsetudta() in filters/muxisom.c:938 passes a NULL pointer as the kind argument to gfisomaddtrackkind().

The function does not validate the kind pointer before passing it to strdup(), which internally calls strlen() on address 0x0, triggering a segmentation fault and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: ./configure --enable-sanitizer && make ; -Command: ./MP4Box -add 23poc.mp4 -new /dev/null

Asan-log: ==748312==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f8d4d70efe6 bp 0x7ffc18a95310 sp 0x7ffc18a94ab8 T0) ==748312==The signal is caused by a READ memory access. #0 0x7f8d4d70efe6 in sanitizer::internalstrlen(char const) ../../../../src/libsanitizer/sanitizercommon/sanitizerlibc.cpp:176 #1 0x7f8d4d6eeba9 in strdup ../../../../src/libsanitizer/asan/asaninterceptors.cpp:574 #2 0x7f8d4bfffe94 in gfisomaddtrackkind isomedia/isomwrite.c:3153

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/23/23poc.mp4

References: https://github.com/gpac/gpac/issues/3260 https://www.cve.org/CVERecord?id=CVE-2025-55639 https://infosec.exchange/@sigdevel/116769184815236865

—— Best regards, Alexander A. Shvedov @sigdevel