GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4() and TraverseShape() that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gfsgvrmlfieldclone() to memcpy from invalid pointers and crash.

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60475 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: Not assessed Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfac4parserbs() function in GPAC's AC-4 parser (mediatools/avparsers.c:16140) accesses AC4SAMPLEDELTATABLE48 using a framerateindex read from the input stream without proper bounds checking. When MP4Box inspects a crafted AC-4 stream, an invalid index causes a 4-byte read beyond the global array boundary.

AddressSanitizer reports a global-buffer-overflow read at address 0x7f8be83df95c, located 4 bytes after the 56-byte global array AC4SAMPLEDELTATABLE48. The read is reached through ac4dmxprobedata() while probing the input file, crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery (2.5-DEV-rev1593-gfe88c3545-master, commit fe88c3545aadd597b250ccf23271d5d3de50ccc8). No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 40gfac4parserbsmediatoolsavparsersc16140

Asan-log: ==1823022==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f8be83df95c at pc 0x7f8be7592fce bp 0x7fff40bffe90 sp 0x7fff40bffe88 READ of size 4 at 0x7f8be83df95c thread T0 #0 0x7f8be7592fcd in gfac4parserbs mediatools/avparsers.c:16140 #1 0x7f8be7ecfcbc in ac4dmxprobedata filters/reframeac4.c:546 #2 0x7f8be7b0262f in gffilterpidrawnew filtercore/filter.c:4704

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/40/40gfac4parserbsmediatoolsavparsersc16140

References: https://github.com/gpac/gpac/issues/3291 https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b https://www.cve.org/CVERecord?id=CVE-2025-60475 https://infosec.exchange/@sigdevel/117456354623831878

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60467 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidinstswapdeletetask() function in GPAC's filter session core (filtercore/filterpid.c:574) is a scheduled task that deletes a GFFilterPidInstance structure during filter PID teardown. When MP4Box inspects a crafted MPEG-2 TS file that drives the filter pipeline through PID reconfiguration and deletion, gffilterpidinstswapdelete() at filtercore/filterpid.c:544 frees the pidinst allocation before the scheduled delete task has executed.

The task callback subsequently performs a READ of 4 bytes at address 0x513000000e7c from the already-freed structure without verifying that the instance is still valid, resulting in a heap-use-after-free and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 37gffilterpidinstswapdeletetaskfiltercorefilterpidc574

Asan-log: ==2014352==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000e7c at pc 0x7fd50dc51b7d bp 0x7ffe25104a20 sp 0x7ffe25104a18 READ of size 4 at 0x513000000e7c thread T0 #0 0x7fd50dc51b7c in gffilterpidinstswapdeletetask filtercore/filterpid.c:574 #1 0x7fd50dcc3465 in gffsthreadproc filtercore/filtersession.c:2420 #2 0x7fd50dcc86c4 in gffsrun filtercore/filtersession.c:2727

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/37/37gffilterpidinstswapdeletetaskfiltercorefilterpidc574

References: https://github.com/gpac/gpac/issues/3286 https://www.cve.org/CVERecord?id=CVE-2025-60467 https://infosec.exchange/@sigdevel/116780518074911144 https://github.com/gpac/gpac/commit/976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60477 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidresolvefiletemplateex function in filtercore/filterpid.c is responsible for resolving output file name templates during DASH segmentation in MP4Box. When input file metadata contains excessively long URLs or HTML-like special characters, the function reaches a strncmp() call at line 9045 without first verifying that one of its pointer arguments is non-NULL.

The NULL pointer is passed directly to strncmp(), causing a READ dereference at address 0x000000000000, which terminates the process immediately. No arbitrary code execution was observed; the impact is limited to Denial of Service.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -dash 100 48gffilterpidresolvefiletemplateexfiltercorefilterpidc9045

Asan-log: ==55159==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f665c8c1cf0 bp 0x7fff48a84ca0 sp 0x7fff48a84430 T0) ==55159==The signal is caused by a READ memory access. #0 0x7f665c8c1cf0 in strncmp ../../../../src/libsanitizer/sanitizercommon/sanitizercommoninterceptors.inc:491 #1 0x7f665b891e64 in gffilterpidresolvefiletemplateex filtercore/filterpid.c:9045 #2 0x7f665b965c1e in dashersetupsources filters/dasher.c:4234

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0 PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/48/48gffilterpidresolvefiletemplateexfiltercorefilterpidc9045

References: https://github.com/gpac/gpac/issues/3301 https://nvd.nist.gov/vuln/detail/CVE-2025-60477 https://infosec.exchange/@sigdevel/116658486442433074

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: 9afeea23f5c6584c02aefe1e1560c2844dfb8f7e CVE: CVE-2025-60493 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L; third-party assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a near-NULL pointer in checkmediaprofile() at applications/mp4box/mp4box.c:3883 while removing system tracks. A crafted or truncated MP4 file containing invalid MPEG-4 Object Descriptors can cause gfisomgetesd() to return a GFESD whose decoderConfig or decoderSpecificInfo fields are NULL. checkmediaprofile() accesses these fields without first validating them, causing a read at address 0x000000000008.

The issue was reproduced in GPAC version 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9.

Impact: Processing attacker-controlled input causes an immediate MP4Box crash and denial of service. The observed fault is a near-NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -nosys 63checkmediaprofileapplicationsmp4boxmp4boxc3883

ASan log excerpt: ==85294==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 ==85294==The signal is caused by a READ memory access. ==85294==Hint: address points to the zero page. #0 in checkmediaprofile applications/mp4box/mp4box.c:3883 #1 in removesystemstracks applications/mp4box/mp4box.c:3937 #2 in removesystemstracks applications/mp4box/mp4box.c:3916

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/63/63checkmediaprofileapplicationsmp4boxmp4boxc3883

References: https://github.com/gpac/gpac/issues/3328 https://github.com/gpac/gpac/commit/9afeea23f5c6584c02aefe1e1560c2844dfb8f7e https://www.cve.org/CVERecord?id=CVE-2025-60493 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60493.json https://infosec.exchange/@sigdevel/117451489672249554

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1699-g31becc9e0-master Commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 Fixed: fcb9083292befe61d3e2466b18edfedba49da098 CVE: CVE-2025-60494 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box performs an invalid read in gfpropsequalinternal() at filtercore/filterprops.c:867 while comparing PID property values. A crafted MP4 file containing malformed or truncated ODF descriptors and box structures causes an invalid pointer to be passed to memcmp(), which then reads from address 0x000011166094.

The issue was reproduced in GPAC version 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9.

Impact: Importing attacker-controlled input causes an immediate MP4Box crash and denial of service. Arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -add 64gfpropsequalinternalfiltercorefilterpropsc867

ASan log excerpt: ==4009521==ERROR: AddressSanitizer: SEGV on unknown address 0x000011166094 ==4009521==The signal is caused by a READ memory access. #0 in memcmpavx2movbertm memcmp-avx2-movbe.S:84 #1 in MemcmpInterceptorCommon sanitizercommoninterceptors.inc:834 #2 in memcmp sanitizercommoninterceptors.inc:845 #4 in gfpropsequalinternal filtercore/filterprops.c:867

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/64/64gfpropsequalinternalfiltercorefilterpropsc867

References: https://github.com/gpac/gpac/issues/3329 https://github.com/gpac/gpac/commit/fcb9083292befe61d3e2466b18edfedba49da098 https://www.cve.org/CVERecord?id=CVE-2025-60494 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60494.json https://infosec.exchange/@sigdevel/117451480059519560

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: 91083fcfce01aa596a13a6962768d13a60bfc8bb CVE: CVE-2025-60497 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CISA assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a NULL pointer in GetESD() at isomedia/track.c:107 during scene loading. A crafted MP4 sample description contains an unknown avC9 atom instead of a valid avcC configuration box. The Object Descriptor loading path nevertheless attempts to retrieve the ES descriptor from the invalid sample entry.

The issue was reproduced in GPAC version 2.5-DEV-rev1780-g50b5741f2-master at commit 50b5741f291126b610c59db433fc02e8a17f0c5d.

Impact: Exporting the crafted scene causes an immediate MP4Box crash and denial of service. The observed fault is a NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -svg 62GetESDisomediatrackc107

ASan log excerpt: ==852440==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 ==852440==The signal is caused by a READ memory access. ==852440==Hint: address points to the zero page. #0 in GetESD isomedia/track.c:107 #1 in GetESDForTime isomedia/track.c:325 #2 in gfisomgetrootod isomedia/isomread.c:764

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/62/62GetESDisomediatrackc107

References: https://github.com/gpac/gpac/issues/3336 https://github.com/gpac/gpac/commit/91083fcfce01aa596a13a6962768d13a60bfc8bb https://www.cve.org/CVERecord?id=CVE-2025-60497 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60497.json https://infosec.exchange/@sigdevel/117451504006040011

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1698-gfc2009fa7-master Commit fc2009fa75631960743f8f7855dda8998167b5ab Fixed: f6128214feb69cd689e4b9944a2621bc4ad8faf0 CVE: CVE-2025-60491 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box contains a heap use-after-free in dasherflushsegment() at filters/dasher.c:8062. While processing a crafted MPEG-2 Transport Stream, dasherconfigurepid() frees a 1096-byte PID context during stream reconfiguration but leaves a stale reference. The segment-flush path later reads four bytes at offset 336 in the freed object.

The issue was reproduced in GPAC version 2.5-DEV-rev1698-gfc2009fa7-master at commit fc2009fa75631960743f8f7855dda8998167b5ab.

Impact: The invalid heap read causes MP4Box to terminate, resulting in denial of service. Because freed memory may be replaced with attacker-influenced data, arbitrary code execution cannot be ruled out.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -dash 1000 61dasherflushsegmentfiltersdasherc8062

ASan log excerpt: ==21426==ERROR: AddressSanitizer: heap-use-after-free on address 0x519000017dd0 #0 in dasherflushsegment filters/dasher.c:8062 #1 in dasherprocess filters/dasher.c:9423 #2 in gffilterprocesstask filtercore/filter.c:3208

The allocation and free traces both identify dasherconfigurepid().

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/61/61dasherflushsegmentfiltersdasherc8062

References: https://github.com/gpac/gpac/issues/3326 https://github.com/gpac/gpac/commit/f6128214feb69cd689e4b9944a2621bc4ad8faf0 https://www.cve.org/CVERecord?id=CVE-2025-60491 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60491.json https://infosec.exchange/@sigdevel/117451513352278768

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1692-g23819fdc0-master Commit 23819fdc02be8d3e92f0ef84831625d51981d7d2 Fixed: 4860a1a6f128ccc9ae37b4b738d22029f9672457 CVE: CVE-2025-60489 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a near-NULL pointer in dasherinserttimelineentry() at filters/dasher.c:7760 while creating a DASH segment timeline. Corrupted DTS metadata in a crafted MP4 file produces an empty segment. A call to gflistlast() then returns NULL, but the returned timeline-entry pointer is used without validation, causing a read at offset 0x0c.

The issue was reproduced in GPAC version 2.5-DEV-rev1692-g23819fdc0-master at commit 23819fdc02be8d3e92f0ef84831625d51981d7d2.

Impact: DASH packaging of attacker-controlled input causes an immediate MP4Box crash and denial of service. The observed fault is a near-NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -segment-timeline -dash 10000 60dasherinserttimelineentryfiltersdasherc7760

ASan log excerpt: ==21798==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000c ==21798==The signal is caused by a READ memory access. ==21798==Hint: address points to the zero page. #0 in dasherinserttimelineentry filters/dasher.c:7760 #1 in dasherinserttimelineentry filters/dasher.c:7623 #2 in dasherflushsegment filters/dasher.c:8005

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/60/60dasherinserttimelineentryfiltersdasherc7760

References: https://github.com/gpac/gpac/issues/3325 https://github.com/gpac/gpac/commit/4860a1a6f128ccc9ae37b4b738d22029f9672457 https://www.cve.org/CVERecord?id=CVE-2025-60489 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60489.json https://infosec.exchange/@sigdevel/117451521960820132

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1687-ge44a4e2b0-master Commit e44a4e2b0d193566619ada71599e70255699da94 Fixed: 8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 CVE: CVE-2025-60492 CWE: CWE-674 (Uncontrolled Recursion) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; CISA assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box can exhaust its process stack while decoding a crafted MPEG-4 BIFS scene. Deeply nested scene nodes cause repeated calls among gfbifsdecnode(), BDDecMFFieldList(), gfbifsdecfield(), and gfbifsdecnodelist() without an effective recursion-depth limit.

The issue was reproduced in GPAC version 2.5-DEV-rev1687-ge44a4e2b0-master at commit e44a4e2b0d193566619ada71599e70255699da94.

Impact: Exporting the crafted scene exhausts the process stack and terminates MP4Box, resulting in denial of service. Arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -x3d 59AnchorCreatescenegraphmpeg4nodesc171

ASan log excerpt: ==4071400==ERROR: AddressSanitizer: stack-overflow on address 0x7ffec640bac8 #6 in gfbifsdecnode bifs/fielddecode.c:905 #7 in BDDecMFFieldList bifs/fielddecode.c:330 #8 in gfbifsdecfield bifs/fielddecode.c:569 #9 in gfbifsdecnodelist bifs/fielddecode.c:631 #10 in gfbifsdecnode bifs/fielddecode.c:933

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/59/59AnchorCreatescenegraphmpeg4nodesc171

References: https://github.com/gpac/gpac/issues/3324 https://github.com/gpac/gpac/commit/8e7b9a3a04331286b89d1803c65a2d6edc11b4c4 https://www.cve.org/CVERecord?id=CVE-2025-60492 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60492.json https://infosec.exchange/@sigdevel/117456655329648201

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-2025-60487 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 6.2 MEDIUM (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a near-NULL pointer in gfisomgetesd() at isomedia/isomread.c:1386 when the NAL-dump command processes an empty or minimal XML file. The ISO media layer has no valid media descriptor, but the function reads a field at offset 0x50 without first validating the descriptor pointer.

The issue was reproduced in GPAC version 2.5-DEV-rev1665-g3f20eb0cd-master at commit 3f20eb0cd22116367c036e6ffe6ace299b38d686.

Impact: Processing attacker-controlled input causes an immediate MP4Box crash and denial of service. The observed fault is a near-NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -dnal 1 56gfisomgetesdisomediaisomreadc1386.xml

ASan log excerpt: ==3903891==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 ==3903891==The signal is caused by a READ memory access. ==3903891==Hint: address points to the zero page. #0 in gfisomgetesd isomedia/isomread.c:1386 #1 in dumpisomnal applications/mp4box/filedump.c:1397 #2 in mp4boxmain applications/mp4box/mp4box.c:6670

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: The reproducer and invocation details are available in the issue report.

References: https://github.com/gpac/gpac/issues/3320 https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b https://www.cve.org/CVERecord?id=CVE-2025-60487 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60487.json https://infosec.exchange/@sigdevel/117456633862790827 https://bdu.fstec.ru/vul/2025-13151

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1665-g3f20eb0cd-master Commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 Fixed: d0793f92e04fe284a25c2a9335cc5edc68deb6d4 CVE: CVE-2025-60490 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box contains a heap use-after-free in gffilterpidsendeventdownstream() at filtercore/filterpid.c:7919. While importing a crafted MPEG-2 Transport Stream, PID reconfiguration frees a 344-byte PID instance in gffilterpidinstswapdelete(). Event propagation later retains and reads the stale pointer.

The issue was reproduced in GPAC version 2.5-DEV-rev1665-g3f20eb0cd-master at commit 3f20eb0cd22116367c036e6ffe6ace299b38d686.

Impact: The observed read of eight bytes at the start of the freed object causes MP4Box to terminate, resulting in denial of service. Because the stale heap object may be replaced with attacker-influenced data, arbitrary code execution cannot be ruled out.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -add 54gffilterpidsendeventdownstreamfiltercorefilterpidc7919 -new /dev/null

ASan log excerpt: ==58521==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000e40 #0 in gffilterpidsendeventdownstream filtercore/filterpid.c:7919 #1 in gffsthreadproc filtercore/filtersession.c:2393 #2 in gffsrun filtercore/filtersession.c:2697

The allocation and free traces identify gffilterpidinstnew() and gffilterpidinstswapdelete(), respectively.

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/54/54gffilterpidsendeventdownstreamfiltercorefilterpidc7919

References: https://github.com/gpac/gpac/issues/3315 https://github.com/gpac/gpac/commit/d0793f92e04fe284a25c2a9335cc5edc68deb6d4 https://www.cve.org/CVERecord?id=CVE-2025-60490 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60490.json https://infosec.exchange/@sigdevel/117456620287496398 https://bdu.fstec.ru/vul/2025-13150

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: f03c946aae129980f0426d4cbae9746d0536fee6 CVE: CVE-2025-60496 CWE: CWE-369 (Divide By Zero) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box performs a division by zero in reframersendpacket() at filters/reframer.c:1026 when splitting a crafted, truncated MP4 file. Upstream parsing leaves stream parameters such as the timescale, estimated file size, or sample rate at zero. The reframer then uses a zero value as a denominator while calculating split boundaries.

The issue was reproduced in GPAC version 2.5-DEV-rev1780-g50b5741f2-master at commit 50b5741f291126b610c59db433fc02e8a17f0c5d.

Impact: Splitting the crafted file raises SIGFPE and terminates MP4Box, resulting in denial of service. Arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -split-size 8000 65reframersendpacketfiltersreframerc1026

ASan log excerpt: [IsoMedia] File truncated, aborting read for track 2 after 2 / 51 samples [Reframer] split computed using current estimation of file size (102487) AddressSanitizer:DEADLYSIGNAL ==573621==ERROR: AddressSanitizer: FPE on unknown address 0x7f1bfc2de393 #0 in reframersendpacket filters/reframer.c:1026 #1 in reframerprocess filters/reframer.c:2698 #2 in gffilterprocesstask filtercore/filter.c:3208 #3 in gffsthreadproc filtercore/filtersession.c:2393

SUMMARY: AddressSanitizer: FPE filters/reframer.c:1026 in reframersendpacket

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/65/65reframersendpacketfiltersreframerc1026

References: https://github.com/gpac/gpac/issues/3334 https://github.com/gpac/gpac/commit/f03c946aae129980f0426d4cbae9746d0536fee6 https://www.cve.org/CVERecord?id=CVE-2025-60496 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60496.json https://infosec.exchange/@sigdevel/117451461416101711

—— Best regards, Alexander A. Shvedov @sigdevel

Subject: CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1678-gb7ffd9f96-master Commit b7ffd9f96bc188dde148300d8c4e510b557563aa Fixed: 75786eb61b7cc838b57c3d4f8004b4f13b5b724c CVE: CVE-2025-60479 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a NULL pointer while collecting scene statistics for a crafted MPEG-4 BIFS scene. A malformed SFVec2f field causes the scene traversal to pass a NULL pointer to StatSFVec2f(), which dereferences it at scenemanager/scenestats.c:192.

The issue was reproduced in GPAC version 2.5-DEV-rev1678-gb7ffd9f96-master at commit b7ffd9f96bc188dde148300d8c4e510b557563aa.

Impact: A crafted MPEG-4 file processed by the scene-statistics command causes an immediate MP4Box crash and denial of service. The observed fault is a NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -nstat 58StatSFVec2fscenemanagerscenestatsc192

ASan log excerpt: MPEG-4 BIFS Scene Parsing Analysing Scene AddressSanitizer:DEADLYSIGNAL ==208690==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 ==208690==The signal is caused by a READ memory access. #0 in StatSFVec2f scenemanager/scenestats.c:192 #1 in StatSingleField scenemanager/scenestats.c:265 #2 in StatSingleField scenemanager/scenestats.c:261 #3 in gfsmstatsforcommand scenemanager/scenestats.c:584

SUMMARY: AddressSanitizer: SEGV scenemanager/scenestats.c:192 in StatSFVec2f

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/58/58StatSFVec2fscenemanagerscenestatsc192

References: https://github.com/gpac/gpac/issues/3322 https://github.com/gpac/gpac/commit/75786eb61b7cc838b57c3d4f8004b4f13b5b724c https://www.cve.org/CVERecord?id=CVE-2025-60479 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60479.json https://infosec.exchange/@sigdevel/117451528497213210 https://bdu.fstec.ru/vul/2025-13152

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-71438 CWE: CWE-125 (Out-of-bounds Read) CVSS 3.1: 5.4 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfodfac4cfgdsiv1 function in odf/descriptors.c uses a stream-supplied framerateindex to index into the fixed-size lookup tables AC4SAMPLEDELTATABLE48 and AC4MEDIATIMESCALE48. The function performs no bounds check before the table access at line 2179, allowing a crafted AC-4 file with an out-of-range index (e.g., 15) to read memory past the end of either table.

The out-of-bounds read returns a NULL or garbage pointer that is subsequently dereferenced, causing a SEGV (READ at address 0x000000000000) and immediate process termination. No evidence of arbitrary code execution was observed; the impact is limited to Denial of Service.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -dash 100 50gfodfac4cfgdsiv1odfdescriptorsc2179

Asan-log: ==56651==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f09a1a8fd3c bp 0x000000000002 sp 0x7fffb433fb30 T0) ==56651==The signal is caused by a READ memory access. #0 0x7f09a1a8fd3c in gfodfac4cfgdsiv1 odf/descriptors.c:2179 #1 0x7f09a1a909b5 in gfodfac4cfgwritebs odf/descriptors.c:2299 #2 0x7f09a1a909b5 in gfodfac4cfgwrite odf/descriptors.c:2306

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/50/50gfodfac4cfgdsiv1odfdescriptorsc2179

References: https://github.com/gpac/gpac/issues/3303 https://nvd.nist.gov/vuln/detail/CVE-2025-71438 https://github.com/gpac/gpac/releases/tag/v26.07.0 https://infosec.exchange/@sigdevel/117484156995584313 https://github.com/gpac/gpac/commit/13eb5b76560aaf7813b865a2ad433258478e2695

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1617-g856674b22-master Commit 856674b226d6cbe28a941ad223be38194cbf7d37 Fixed: c592a144bbe339ee581ca88aaa3247362795b742 CVE: CVE-2025-60478 CWE: CWE-416 (Use After Free) CVSS 3.1: 7.8 HIGH (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box contains a heap use-after-free in gffilterpacketdestroy() at filtercore/filterpck.c:678. A crafted MPEG-2 TS file with malformed PMT/PAT data and empty DASH segment state causes GPAC to mishandle packet ownership. The output and PID packet-drop paths later write to a packet object that has already been freed.

The issue was reproduced in GPAC version 2.5-DEV-rev1617-g856674b22-master at commit 856674b226d6cbe28a941ad223be38194cbf7d37.

Impact: Processing the crafted transport stream during DASH segmentation can crash MP4Box and cause denial of service. The four-byte write to freed heap memory also presents memory-corruption and potential code-execution risk.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -dash 100 47gffilterpacketdestroyfiltercorefilterpckc678

ASan log excerpt: ==53942==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000001054 WRITE of size 4 at 0x513000001054 thread T0 #0 in gffilterpacketdestroy filtercore/filterpck.c:678 #1 in gffilterpacketdestroy filtercore/filterpck.c:684 #2 in gffilterpiddroppacket filtercore/filterpid.c:7270 #3 in fileoutprocess filters/outfile.c:933 #4 in gffilterprocesstask filtercore/filter.c:3201

SUMMARY: AddressSanitizer: heap-use-after-free filtercore/filterpck.c:678 in gffilterpacketdestroy

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/47/47gffilterpacketdestroyfiltercorefilterpckc678

References: https://github.com/gpac/gpac/issues/3300 https://github.com/gpac/gpac/commit/c592a144bbe339ee581ca88aaa3247362795b742 https://www.cve.org/CVERecord?id=CVE-2025-60478 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60478.json https://infosec.exchange/@sigdevel/117456560052551246 https://bdu.fstec.ru/vul/2025-09883

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60476 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box contains a heap use-after-free in gfodfac4cfgcleanlist() in odf/descriptors.c. When a crafted AC-4 stream with malformed configuration list data is parsed, recursive cleanup frees a list node in a deeper invocation. The caller later reads the same node at odf/descriptors.c:2419.

AddressSanitizer reports an eight-byte read 80 bytes into an 88-byte heap region after that region was freed by the same cleanup routine. The issue was reproduced in GPAC version 2.5-DEV-rev1593-gfe88c3545-master at commit fe88c3545aadd597b250ccf23271d5d3de50ccc8.

Impact: Processing the crafted file can crash MP4Box and cause denial of service. Because the fault is a heap use-after-free, the CVE and BDU records also identify a potential arbitrary-code-execution impact.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -info 42gfodfac4cfgcleanlistodfdescriptorsc2419

ASan log excerpt: ==1841011==ERROR: AddressSanitizer: heap-use-after-free on address 0x508000000470 READ of size 8 at 0x508000000470 thread T0 #0 in gfodfac4cfgcleanlist odf/descriptors.c:2419 #1 in gfodfac4cfgcleanlist odf/descriptors.c:2400 #2 in gfac4parserbs mediatools/avparsers.c:16101 #3 in ac4dmxprocess filters/reframeac4.c:388

0x508000000470 is located 80 bytes inside of 88-byte region [0x508000000420,0x508000000478) freed by thread T0 in gfodfac4cfgcleanlist at descriptors.c:2432.

SUMMARY: AddressSanitizer: heap-use-after-free odf/descriptors.c:2419 in gfodfac4cfgcleanlist

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/42/42gfodfac4cfgcleanlistodfdescriptorsc2419

References: https://github.com/gpac/gpac/issues/3293 https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b https://www.cve.org/CVERecord?id=CVE-2025-60476 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60476.json https://infosec.exchange/@sigdevel/117456471347684902 https://bdu.fstec.ru/vul/2025-08612

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: 2.5-DEV-rev1593-gfe88c3545-master Commit fe88c3545aadd597b250ccf23271d5d3de50ccc8 Fixed: e02d1fd24cdc26acb1b236ab38b3832cffcae21b CVE: CVE-2025-60469 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H; BDU assessment) Reporter: Alexander A. Shvedov (@sigdevel)

Description: MP4Box dereferences a NULL or invalid pointer while parsing a crafted AC-4 stream. The stream declares an unsupported presentation version and omits required substream group information. After reporting that presentationversion 0 is unsupported and that substream group 1 cannot be found, the error path reaches gfac4presentationchmode() in mediatools/avparsers.c:15641 and reads from address 0x48.

The issue was reproduced in GPAC version 2.5-DEV-rev1593-gfe88c3545-master at commit fe88c3545aadd597b250ccf23271d5d3de50ccc8.

Impact: A crafted AC-4 file processed by MP4Box can cause an application crash and denial of service. The observed fault is a near-NULL read; arbitrary code execution was not demonstrated.

Reproduction: Build GPAC with AddressSanitizer, then run:

./MP4Box -info 41gfac4presentationchmodemediatoolsavparsersc15641

ASan log excerpt: [AC4] Don't support presentationversion 0. [AC4] Cannot find substream group 1 for presentation 0 AddressSanitizer:DEADLYSIGNAL ==1829578==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000048 ==1829578==The signal is caused by a READ memory access. #0 in gfac4presentationchmode mediatools/avparsers.c:15641 #1 in gfac4rawframe mediatools/avparsers.c:15976 #2 in gfac4parserbs mediatools/avparsers.c:16113 #3 in ac4dmxprocess filters/reframeac4.c:388

SUMMARY: AddressSanitizer: SEGV mediatools/avparsers.c:15641 in gfac4presentationchmode

Fix: Update to a GPAC v26.07.0:

https://github.com/gpac/gpac/releases/tag/v26.07.0

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/41/41gfac4presentationchmodemediatoolsavparsersc15641

References: https://github.com/gpac/gpac/issues/3292 https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b236ab38b3832cffcae21b https://www.cve.org/CVERecord?id=CVE-2025-60469 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/60xxx/CVE-2025-60469.json https://infosec.exchange/@sigdevel/117456377012352192 https://bdu.fstec.ru/vul/2025-08611

—— Best regards, Alexander A. Shvedov @sigdevel

A NULL pointer dereference in the StatSFVec2f function (/scenemanager/scenestats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.

A NULL pointer dereference in the dasherinserttimelineentry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

An out-of-bounds read in gfodfac4cfgdsiv1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A heap use-after-free in the dasherflushsegment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the checkmediaprofile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the gfisomgetesd function (/isomedia/isomread.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

A segmentation violation in the gfpropsequalinternal function (/filtercore/filterprops.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

A use-after-free in the gffilterpidgetpacket function (filtercore/filterpid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

A segmentation violation in the dumpisomsaps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8) CVE: CVE-2025-55653 CWE: CWE-369 (Divide by Zero) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>

Description: When MP4Box imports a crafted MP4 file containing an invalid fractional value with a zero denominator in its metadata, the gfparselfrac() function in utils/error.c performs division at line 2290 without validating that the divisor is non-zero. The zero denominator is supplied to gfparselfrac() via filelistnexturl() during file list processing, triggering a SIGFPE (floating-point exception) that immediately terminates the process with no possibility of recovery.

AddressSanitizer reports an FPE on unknown address at utils/error.c:2290, reached via filelistnexturl() / filelistloadnext() / filelistprocess() while MP4Box imports the crafted track.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 21poc.mp4 -new /dev/null

Asan-log: AddressSanitizer:DEADLYSIGNAL ==2271001==ERROR: AddressSanitizer: FPE on unknown address 0x7fda0295e0a9 (pc 0x7fda0295e0a9 bp 0x7fd9ffb06e40 sp 0x7ffde8bd1ce0 T0) #0 0x7fda0295e0a9 in gfparselfrac utils/error.c:2290 #1 0x7fda03674ce1 in filelistnexturl filters/filelist.c:1029 #2 0x7fda03675521 in filelistloadnext filters/filelist.c:1225 #3 0x7fda03684257 in filelistprocess filters/filelist.c:2011 #4 0x7fda034ed4b1 in gffilterprocesstask filtercore/filter.c:3179 #5 0x7fda034c0a05 in gffsthreadproc filtercore/filtersession.c:2420 #6 0x7fda034c5c64 in gffsrun filtercore/filtersession.c:2727 #7 0x7fda02fa8e1d in gfmediaimport mediatools/mediaimport.c:1601 #8 0x55f8f6205be6 in importfile applications/mp4box/fileimport.c:1693

AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE utils/error.c:2290 in gfparselfrac

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/21/21poc.mp4

References: https://github.com/gpac/gpac/issues/3247 https://www.cve.org/CVERecord?id=CVE-2025-55653 https://infosec.exchange/@sigdevel/116769079013422405

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (321624f28d19a413449fd1718d1eb59037f8f7fc) CVE: CVE-2025-55640 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>

Description: When MP4Box imports a crafted MP4 file containing manipulated sample metadata (corrupted sample counts, invalid aspect ratios, and oversized box declarations), the stblAddSize() function in isomedia/stblwrite.c fails to validate sample count boundaries before writing to the sample size table (stsz box). The function writes beyond the allocated heap buffer for stbl->sampleSize->sizes, resulting in a heap-buffer-overflow.

AddressSanitizer reports a WRITE of size 4 at isomedia/stblwrite.c:492 immediately after a 64-byte heap allocation, reached via mp4muxprocesssample() / gfisomaddsample() / trakaddsample() / MediaAddSample() while MP4Box imports the crafted track.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 25poc.mp4 -new /dev/null

Asan-log: ==459908==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000006480 at pc 0x7f708f8531f1 bp 0x7fff5014c390 sp 0x7fff5014c388 WRITE of size 4 at 0x506000006480 thread T0 #0 0x7f708f8531f0 in stblAddSize isomedia/stblwrite.c:492 #1 0x7f708f80cb60 in MediaAddSample isomedia/media.c:1033 #2 0x7f708f7d12fb in trakaddsample isomedia/isomwrite.c:1048 #3 0x7f708f7d1f33 in gfisomaddsample isomedia/isomwrite.c:1120 #4 0x7f70901cdf7f in mp4muxprocesssample filters/muxisom.c:5103 #5 0x7f70901f7a09 in mp4muxprocess filters/muxisom.c:7701 #6 0x7f708feed9d1 in gffilterprocesstask filtercore/filter.c:3179 #7 0x7f708fec0d25 in gffsthreadproc filtercore/filtersession.c:2420 #8 0x7f708fec5f84 in gffsrun filtercore/filtersession.c:2727 #9 0x7f708f9a931d in gfmediaimport mediatools/mediaimport.c:1601 #10 0x55c0e9ef2be6 in importfile applications/mp4box/fileimport.c:1693

0x506000006480 is located 0 bytes after 64-byte region [0x506000006440,0x506000006480) allocated by thread T0 here: #0 0x7f7090ef4c77 in malloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:69 #1 0x7f708f85a080 in stblSampleSizeAppend isomedia/stblwrite.c:1678

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/stblwrite.c:492 in stblAddSize

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/25/25poc.mp4

References: https://github.com/gpac/gpac/issues/3261 https://www.cve.org/CVERecord?id=CVE-2025-55640 https://infosec.exchange/@sigdevel/116769271709415444

—— Best regards, Alexander A. Shvedov @sigdevel