CVE-2025-55645

Analyzed Analyzed - Analysis Complete

Heap Buffer Overflow in GPAC MP4Box

Publication date: 2026-06-15

Last updated on: 2026-06-16

Assigner: MITRE

Description

A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-06-15

EPSS Evaluated

2026-07-04

NVD

CVE-2025-55645

EUVD

EUVD-2025-210145

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer overflow in the gf_cenc_set_pssh function within the isomedia/drm_sample.c file of GPAC MP4Box version 2.4. It occurs when the function processes a specially crafted MP4 file, leading to memory corruption.

An attacker can exploit this flaw by supplying a malicious MP4 file that triggers the overflow.

Impact Analysis

Exploiting this vulnerability can cause a Denial of Service (DoS) condition, meaning the affected application or system may crash or become unresponsive when processing the crafted MP4 file.

Compliance Impact

The provided information does not specify how the heap buffer overflow vulnerability in GPAC MP4Box v2.4 affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or suspicious MP4 files with GPAC MP4Box until a fixed version is applied.

Update GPAC MP4Box to a version that includes the fix for this vulnerability, specifically versions including or after the commit e95f3064d846e4606276fff111e0f97df1576a04.

If updating is not immediately possible, consider restricting access to MP4Box to trusted users and environments only, and monitor for any abnormal crashes or Denial of Service symptoms.

Detection Guidance

This vulnerability can be detected by testing the GPAC MP4Box application with a crafted MP4 file containing an oversized Protection System Specific Header (PSSH) payload. A proof-of-concept (PoC) file is available to trigger the heap buffer overflow in the gf_cenc_set_pssh function.

To detect the vulnerability on your system, you can run MP4Box against the PoC crafted MP4 file and observe if it crashes or behaves unexpectedly, indicating the presence of the heap buffer overflow.

Example command to test MP4Box with the crafted file (replace poc_file.mp4 with the actual PoC file):

mp4box -info poc_file.mp4
mp4box -dump poc_file.mp4

If MP4Box crashes or shows abnormal behavior during processing, it indicates the vulnerability is present.

Hi! I’m here to help you understand CVE-2025-55645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70