Segmentation Violation in GPAC MP4Box via Crafted MP4 File

Executive Summary

CVE-2025-55667 is a segmentation fault vulnerability in GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-master. It occurs in the dump_isom_saps function in filedump.c when processing corrupted MP4 files with invalid track structures. The function fails to validate track metadata pointers before dereferencing them during Sync Access Point analysis, leading to a crash when accessing null or invalid memory addresses.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can use AddressSanitizer (ASan) to monitor for segmentation faults when processing MP4 files with GPAC MP4Box. Run the command ./MP4Box -dsap 1 <crafted_file.mp4> and check for SEGV errors. Ensure GPAC is compiled with debugging symbols for accurate detection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a specially crafted MP4 file. If exploited, it can crash the MP4Box application, disrupting media processing tasks. Users processing untrusted MP4 files may experience unexpected program termination.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a segmentation fault in GPAC MP4Box caused by processing corrupted MP4 files. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical DoS issue in media processing software rather than a data protection or privacy breach.

Useful 0 Not Useful 0

Mitigation Strategies

Update GPAC to the latest patched version, specifically commit e6d0182 or later, which includes null checks in the dump_isom_saps function. Avoid processing untrusted MP4 files until patched. Monitor for crashes in MP4Box when handling files with invalid track structures.

Useful 0 Not Useful 0