Heap Buffer Overflow in GPAC MP4Box via Malicious MP4 File

Executive Summary

This vulnerability is a heap buffer overflow in the stbl_AddSize function of GPAC MP4Box v2.4. It occurs when processing a crafted MP4 file, leading to a Denial of Service (DoS) condition.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or segmentation faults when processing MP4 files with MP4Box. Use the command ./MP4Box -add [file.mp4] -new /dev/null to test files. If a crash occurs, it may indicate exploitation of CVE-2025-55640.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows attackers to crash the MP4Box application by providing a specially crafted MP4 file. This could disrupt services relying on MP4Box for media processing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical DoS issue in MP4Box. However, if exploited, it could disrupt systems processing media files, potentially leading to service unavailability which may impact data processing operations subject to these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to the latest version to patch the heap buffer overflow in stbl_AddSize. Avoid processing untrusted MP4 files until patched.

Useful 0 Not Useful 0