CVE-2025-55667

Deferred Deferred - Pending Action

Segmentation Violation in GPAC MP4Box via Crafted MP4 File

Publication date: 2026-10-19

Last updated on: 2026-10-28

Assigner: MITRE

Description

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-28

Generated

2026-11-09

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2025-55667

EUVD

EUVD-2025-211130

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	n/a	n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

CVE-2025-55667 is a segmentation fault vulnerability in GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-master. It occurs in the dump_isom_saps function in filedump.c when processing corrupted MP4 files with invalid track structures. The function fails to validate track metadata pointers before dereferencing them during Sync Access Point analysis, leading to a crash when accessing null or invalid memory addresses.

Detection Guidance

To detect this vulnerability, you can use AddressSanitizer (ASan) to monitor for segmentation faults when processing MP4 files with GPAC MP4Box. Run the command ./MP4Box -dsap 1 <crafted_file.mp4> and check for SEGV errors. Ensure GPAC is compiled with debugging symbols for accurate detection.

Impact Analysis

This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted MP4 file. If exploited, it can crash the MP4Box application, disrupting media processing tasks. Users processing untrusted MP4 files may experience unexpected program termination.

Compliance Impact

This vulnerability is a segmentation fault in GPAC MP4Box caused by processing corrupted MP4 files. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical DoS issue in media processing software rather than a data protection or privacy breach.

Mitigation Strategies

Update GPAC to the latest patched version, specifically commit e6d0182 or later, which includes null checks in the dump_isom_saps function. Avoid processing untrusted MP4 files until patched. Monitor for crashes in MP4Box when handling files with invalid track structures.

Hi! I’m here to help you understand CVE-2025-55667. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...