CVE-2025-55650

Analyzed Analyzed - Analysis Complete

Heap Use-After-Free in GPAC MP4Box

Publication date: 2026-06-15

Last updated on: 2026-06-16

Assigner: MITRE

Description

A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-15

Last Modified

2026-06-16

Generated

2026-07-06

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-04

NVD

CVE-2025-55650

EUVD

EUVD-2025-210149

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	to 26.02.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

This vulnerability is a heap use-after-free issue in the function gf_node_get_tag within the GPAC MP4Box software, specifically in the scenegraph/base_scenegraph.c file. It occurs when the program improperly accesses memory that has already been freed, which can be triggered by supplying a specially crafted MP4 file.

Impact Analysis

An attacker can exploit this vulnerability to cause a Denial of Service (DoS) condition. This means the affected software could crash or become unresponsive when processing a maliciously crafted MP4 file, potentially disrupting normal operations.

Detection Guidance

This vulnerability can be detected by observing crashes or abnormal behavior when MP4Box processes crafted MP4 files with the -svg option. Using AddressSanitizer during testing can help identify the heap use-after-free in the SVG node handling code.

A practical detection method involves running MP4Box on suspicious or untrusted MP4 files with the -svg option enabled and monitoring for crashes or memory errors.

Example command to test a file for the vulnerability (replace <file.mp4> with your test file):

MP4Box -svg <file.mp4>

If the program crashes or AddressSanitizer reports a use-after-free error during this operation, the vulnerability is present.

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or crafted MP4 files with MP4Box, especially using the -svg option.

Updating GPAC MP4Box to a version that includes the fix (post commit 46be5f928660530d5332cd2f1d177208737558ef) is recommended to prevent exploitation.

If updating is not immediately possible, consider running MP4Box in a restricted environment or sandbox to limit the impact of potential crashes or denial of service.

Hi! I’m here to help you understand CVE-2025-55650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70