A NULL pointer dereference in the dasherinserttimelineentry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A segmentation violation in the gfisomgetesd function (/isomedia/isomread.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.

A heap use-after-free in the gffilterpidsendeventdownstream function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A stack overflow in the gfbifsdecnode function (/bifs/fielddecode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A use-after-free in the gffilterpidgetpacket function (filtercore/filterpid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

A segmentation violation in the dumpisomsaps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8) CVE: CVE-2025-55653 CWE: CWE-369 (Divide by Zero) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>

Description: When MP4Box imports a crafted MP4 file containing an invalid fractional value with a zero denominator in its metadata, the gfparselfrac() function in utils/error.c performs division at line 2290 without validating that the divisor is non-zero. The zero denominator is supplied to gfparselfrac() via filelistnexturl() during file list processing, triggering a SIGFPE (floating-point exception) that immediately terminates the process with no possibility of recovery.

AddressSanitizer reports an FPE on unknown address at utils/error.c:2290, reached via filelistnexturl() / filelistloadnext() / filelistprocess() while MP4Box imports the crafted track.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 21poc.mp4 -new /dev/null

Asan-log: AddressSanitizer:DEADLYSIGNAL ==2271001==ERROR: AddressSanitizer: FPE on unknown address 0x7fda0295e0a9 (pc 0x7fda0295e0a9 bp 0x7fd9ffb06e40 sp 0x7ffde8bd1ce0 T0) #0 0x7fda0295e0a9 in gfparselfrac utils/error.c:2290 #1 0x7fda03674ce1 in filelistnexturl filters/filelist.c:1029 #2 0x7fda03675521 in filelistloadnext filters/filelist.c:1225 #3 0x7fda03684257 in filelistprocess filters/filelist.c:2011 #4 0x7fda034ed4b1 in gffilterprocesstask filtercore/filter.c:3179 #5 0x7fda034c0a05 in gffsthreadproc filtercore/filtersession.c:2420 #6 0x7fda034c5c64 in gffsrun filtercore/filtersession.c:2727 #7 0x7fda02fa8e1d in gfmediaimport mediatools/mediaimport.c:1601 #8 0x55f8f6205be6 in importfile applications/mp4box/fileimport.c:1693

AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE utils/error.c:2290 in gfparselfrac

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/21/21poc.mp4

References: https://github.com/gpac/gpac/issues/3247 https://www.cve.org/CVERecord?id=CVE-2025-55653 https://infosec.exchange/@sigdevel/116769079013422405

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (321624f28d19a413449fd1718d1eb59037f8f7fc) CVE: CVE-2025-55640 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: @sigdevel (Alexander Shvedov) <https://infosec.exchange/@sigdevel>

Description: When MP4Box imports a crafted MP4 file containing manipulated sample metadata (corrupted sample counts, invalid aspect ratios, and oversized box declarations), the stblAddSize() function in isomedia/stblwrite.c fails to validate sample count boundaries before writing to the sample size table (stsz box). The function writes beyond the allocated heap buffer for stbl->sampleSize->sizes, resulting in a heap-buffer-overflow.

AddressSanitizer reports a WRITE of size 4 at isomedia/stblwrite.c:492 immediately after a 64-byte heap allocation, reached via mp4muxprocesssample() / gfisomaddsample() / trakaddsample() / MediaAddSample() while MP4Box imports the crafted track.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ; -Command: ./MP4Box -add 25poc.mp4 -new /dev/null

Asan-log: ==459908==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x506000006480 at pc 0x7f708f8531f1 bp 0x7fff5014c390 sp 0x7fff5014c388 WRITE of size 4 at 0x506000006480 thread T0 #0 0x7f708f8531f0 in stblAddSize isomedia/stblwrite.c:492 #1 0x7f708f80cb60 in MediaAddSample isomedia/media.c:1033 #2 0x7f708f7d12fb in trakaddsample isomedia/isomwrite.c:1048 #3 0x7f708f7d1f33 in gfisomaddsample isomedia/isomwrite.c:1120 #4 0x7f70901cdf7f in mp4muxprocesssample filters/muxisom.c:5103 #5 0x7f70901f7a09 in mp4muxprocess filters/muxisom.c:7701 #6 0x7f708feed9d1 in gffilterprocesstask filtercore/filter.c:3179 #7 0x7f708fec0d25 in gffsthreadproc filtercore/filtersession.c:2420 #8 0x7f708fec5f84 in gffsrun filtercore/filtersession.c:2727 #9 0x7f708f9a931d in gfmediaimport mediatools/mediaimport.c:1601 #10 0x55c0e9ef2be6 in importfile applications/mp4box/fileimport.c:1693

0x506000006480 is located 0 bytes after 64-byte region [0x506000006440,0x506000006480) allocated by thread T0 here: #0 0x7f7090ef4c77 in malloc ../../../../src/libsanitizer/asan/asanmalloclinux.cpp:69 #1 0x7f708f85a080 in stblSampleSizeAppend isomedia/stblwrite.c:1678

SUMMARY: AddressSanitizer: heap-buffer-overflow isomedia/stblwrite.c:492 in stblAddSize

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/25/25poc.mp4

References: https://github.com/gpac/gpac/issues/3261 https://www.cve.org/CVERecord?id=CVE-2025-55640 https://infosec.exchange/@sigdevel/116769271709415444

—— Best regards, Alexander A. Shvedov @sigdevel

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac() to divide by zero, terminating the process with SIGFPE.

A heap buffer overflow in the stblAddSize function (isomedia/stblwrite.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gfm2tsdecodeait of the file src/mediatools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gfmxv of the file utils/osthread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.

A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gfrtpparsettxt of the file src/ietf/rtpdepacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. The affected component should be upgraded.

A weakness has been identified in GPAC 26.08-DEV. This impacts the function waitforheaderandparse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.24 mitigates this issue. The patch is identified as e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is recommended.

A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gfsgcommanddel of the file src/scenegraph/commands.c of the component BIFS Handler. The manipulation leads to use after free. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version abi-16.24 is sufficient to resolve this issue. The identifier of the patch is e34f4ba349d55cd1849f0bcf4cf46552732e2db7. It is suggested to upgrade the affected component.

A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gfnodedeactivateex of the file src/scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.

A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handler. Executing a manipulation of the argument payloadsize can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended.

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gfnodeactivateex of the file scenegraph/basescenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gfurlconcatenateex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gfmogetodid of the file compositor/mediaobject.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmxprocess of the file filters/reframempgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.