A NULL pointer dereference in the dasherinserttimelineentry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A segmentation violation in the gfisomgetesd function (/isomedia/isomread.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
A heap use-after-free in the gffilterpidsendeventdownstream function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A stack overflow in the gfbifsdecnode function (/bifs/fielddecode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
A use-after-free in the gffilterpidgetpacket function (filtercore/filterpid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
A segmentation violation in the dumpisomsaps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8) CVE: CVE-2025-55653 CWE: CWE-369 (Divide by Zero) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>
Description: When MP4Box imports a crafted MP4 file containing an invalid fractional value with a zero denominator in its metadata, the gfparselfrac() function in utils/error.c performs division at line 2290 without validating that the divisor is non-zero. The zero denominator is supplied to gfparselfrac() via filelistnexturl() during file list processing, triggering a SIGFPE (floating-point exception) that immediately terminates the process with no possibility of recovery.
AddressSanitizer reports an FPE on unknown address at utils/error.c:2290, reached via filelistnexturl() / filelistloadnext() / filelistprocess() while MP4Box imports the crafted track.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 21poc.mp4 -new /dev/null
Asan-log: AddressSanitizer:DEADLYSIGNAL ==2271001==ERROR: AddressSanitizer: FPE on unknown address 0x7fda0295e0a9 (pc 0x7fda0295e0a9 bp 0x7fd9ffb06e40 sp 0x7ffde8bd1ce0 T0) #0 0x7fda0295e0a9 in gfparselfrac utils/error.c:2290 #1 0x7fda03674ce1 in filelistnexturl filters/filelist.c:1029 #2 0x7fda03675521 in filelistloadnext filters/filelist.c:1225 #3 0x7fda03684257 in filelistprocess filters/filelist.c:2011 #4 0x7fda034ed4b1 in gffilterprocesstask filtercore/filter.c:3179 #5 0x7fda034c0a05 in gffsthreadproc filtercore/filtersession.c:2420 #6 0x7fda034c5c64 in gffsrun filtercore/filtersession.c:2727 #7 0x7fda02fa8e1d in gfmediaimport mediatools/mediaimport.c:1601 #8 0x55f8f6205be6 in importfile applications/mp4box/fileimport.c:1693
AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE utils/error.c:2290 in gfparselfrac
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/21/21poc.mp4
References: https://github.com/gpac/gpac/issues/3247 https://www.cve.org/CVERecord?id=CVE-2025-55653 https://infosec.exchange/@sigdevel/116769079013422405
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (321624f28d19a413449fd1718d1eb59037f8f7fc) CVE: CVE-2025-55640 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>
Description: When MP4Box imports a crafted MP4 file containing manipulated sample metadata (corrupted sample counts, invalid aspect ratios, and oversized box declarations), the stblAddSize() function in isomedia/stblwrite.c fails to validate sample count boundaries before writing to the sample size table (stsz box). The function writes beyond the allocated heap buffer for stbl->sampleSize->sizes, resulting in a heap-buffer-overflow.
AddressSanitizer reports a WRITE of size 4 at isomedia/stblwrite.c:492 immediately after a 64-byte heap allocation, reached via mp4muxprocesssample() / gfisomaddsample() / trakaddsample() / MediaAddSample() while MP4Box imports the crafted track.
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 25poc.mp4 -new /dev/null
Asan-log: ==459908==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000006480 at pc 0x7f708f8531f1 bp 0x7fff5014c390 sp 0x7fff5014c388 WRITE of size 4 at 0x506000006480 thread T0 #0 0x7f708f8531f0 in stblAddSize isomedia/stblwrite.c:492 #1 0x7f708f80cb60 in MediaAddSample isomedia/media.c:1033 #2 0x7f708f7d12fb in trakaddsample isomedia/isomwrite.c:1048 #3 0x7f708f7d1f33 in gfisomaddsample isomedia/isomwrite.c:1120 #4 0x7f70901cdf7f in mp4muxprocesssample filters/muxisom.c:5103 #5 0x7f70901f7a09 in mp4muxprocess filters/muxisom.c:7701 #6 0x7f708feed9d1 in gffilterprocesstask filtercore/filter.c:3179 #7 0x7f708fec0d25 in gffsthreadproc filtercore/filtersession.c:2420 #8 0x7f708fec5f84 in gffsrun filtercore/filtersession.c:2727 #9 0x7f708f9a931d in gfmediaimport mediatools/mediaimport.c:1601 #10 0x55c0e9ef2be6 in importfile applications/mp4box/fileimport.c:1693
0x506000006480 is located 0 bytes after 64-byte region [0x506000006440,0x506000006480) allocated by thread T0 here: #0 0x7f7090ef4c77 in malloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:69 #1 0x7f708f85a080 in stblSampleSizeAppend isomedia/stblwrite.c:1678
SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/stblwrite.c:492 in stblAddSize
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/25/25poc.mp4
References: https://github.com/gpac/gpac/issues/3261 https://www.cve.org/CVERecord?id=CVE-2025-55640 https://infosec.exchange/@sigdevel/116769271709415444
—— Best regards, Alexander A. Shvedov @sigdevel
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac() to divide by zero, terminating the process with SIGFPE.
A heap buffer overflow in the stblAddSize function (isomedia/stblwrite.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gfnodedeactivateex of the file src/scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.
A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
A vulnerability has been found in GPAC 26.07.0. Affected is the function gfsgdomeventbubble of the file src/scenegraph/domevents.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.
A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfieldcount of the file scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.
A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stblGetSampleInfos of the file isomedia/stblread.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.
A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.
A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmtparseelement of the file scenemanager/loaderxmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.