Use-After-Free in GPAC MP4Box

Executive Summary

CVE-2025-55654 is a use-after-free vulnerability in GPAC MP4Box v2.4. It occurs in the gf_filter_pid_get_packet function when processing crafted files with the -nhml option. The flaw allows attackers to cause a Denial of Service by accessing memory that has already been freed, leading to a crash.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes when processing files with GPAC MP4Box using the -nhml option. Monitor for segmentation faults or heap-use-after-free errors when handling crafted files. Use AddressSanitizer or similar tools during execution to detect memory corruption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause applications using GPAC MP4Box to crash when processing malicious files. If exploited, it may lead to unexpected termination of the application, potential data loss, or disruption of media processing tasks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a use-after-free issue in GPAC MP4Box that causes a Denial of Service (DoS) via crafted files. It does not directly affect compliance with standards like GDPR or HIPAA, as it primarily impacts system availability rather than data confidentiality or integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC MP4Box to the latest version that includes the fix from commit 0ccd292. Avoid using the -nhml option with untrusted files. If possible, disable NHML extensions for output to null or invalid paths to prevent the issue.

Useful 0 Not Useful 0