CVE-2025-55661
Undergoing Analysis Undergoing Analysis - In Progress

Heap Buffer Overflow in GPAC MP4Box

Publication date: 2026-06-15

Last updated on: 2026-06-15

Assigner: MITRE

Description
A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-15
Last Modified
2026-06-15
Generated
2026-07-06
AI Q&A
2026-06-15
EPSS Evaluated
2026-07-04
NVD
CVE-2025-55661
EUVD
EUVD-2025-210152

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac mp4box 2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box version 2.4. It occurs when the software processes a specially crafted MP4 file, which causes it to overwrite memory in the heap.

Such a buffer overflow can lead to unexpected behavior, including crashes or denial of service.

Impact Analysis

The primary impact of this vulnerability is that an attacker can cause a Denial of Service (DoS) by supplying a maliciously crafted MP4 file to the vulnerable GPAC MP4Box software.

This means the software may crash or become unresponsive, disrupting normal operations.

Compliance Impact

The provided information does not include any details on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability can be detected by processing a specially crafted MP4 file containing a malformed Opus audio packet with an invalid TOC code 3 length using GPAC MP4Box. The heap buffer overflow occurs in the function gf_opus_parse_packet_header() when it fails to validate the input buffer size properly.

To detect the overflow, one can use AddressSanitizer while running MP4Box on the crafted file to identify the heap buffer overflow.

No specific network detection commands are provided, but detection involves reproducing the crash by feeding the crafted MP4 file to MP4Box and monitoring for crashes or memory errors.

Mitigation Strategies

Immediate mitigation steps include avoiding processing untrusted or specially crafted MP4 files with GPAC MP4Box versions prior to the fix commit ff8249a407685d00ceb5f4d2a798b9cad195140e.

Applying the patch or updating GPAC MP4Box to a version that includes the fix for this heap buffer overflow is recommended.

Additionally, running MP4Box with memory error detection tools like AddressSanitizer can help identify issues during testing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-55661. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart