CVE-2025-55644

Analyzed Analyzed - Analysis Complete

Heap Use-After-Free in GPAC MP4Box via Crafted MP4 File

Publication date: 2026-06-15

Last updated on: 2026-06-16

Assigner: MITRE

Description

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-04

NVD

CVE-2025-55644

EUVD

EUVD-2025-210144

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Detection Guidance

This vulnerability can be detected by attempting to process a specially crafted MP4 file that triggers the use-after-free condition in GPAC/MP4Box. A proof-of-concept file is available which can be used to test if your version of MP4Box is vulnerable.

Specifically, the vulnerability is triggered during MP4Box's decoding of the BIFS command list when performing an -svg scene dump.

A suggested command to test for the vulnerability is to run MP4Box with the -svg option on a crafted MP4 file that contains an invalid BIFS GlobalQuantizer command, for example:

mp4box -svg crafted_vulnerable_file.mp4

If the program crashes or exhibits a denial of service, it indicates the presence of the vulnerability.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability is a heap use-after-free issue in the gf_node_get_tag function located in the scenegraph/base_scenegraph.c file of GPAC MP4Box version 2.4. It occurs when the program improperly accesses memory that has already been freed, which can be triggered by supplying a specially crafted MP4 file.

Impact Analysis

Exploiting this vulnerability allows an attacker to cause a Denial of Service (DoS) condition. This means the affected application, GPAC MP4Box v2.4, could crash or become unresponsive when processing a maliciously crafted MP4 file.

Mitigation Strategies

Immediate mitigation steps include updating GPAC/MP4Box to a version that contains the fix for this vulnerability. The fix is included in versions after the commit f5b7cdc63a7f3269040778c5431a8f6c310bc9f3.

Until the update can be applied, avoid processing untrusted or crafted MP4 files that could exploit this use-after-free vulnerability.

Hi! I’m here to help you understand CVE-2025-55644. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70