CVE-2025-55640
Deferred Deferred - Pending Action

Heap Buffer Overflow in GPAC MP4Box via Malicious MP4 File

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2025-55640
EUVD
EUVD-2025-211111

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in the stbl_AddSize function of GPAC MP4Box v2.4. It occurs when processing a crafted MP4 file, leading to a Denial of Service (DoS) condition.

Impact Analysis

The vulnerability allows attackers to crash the MP4Box application by providing a specially crafted MP4 file. This could disrupt services relying on MP4Box for media processing.

Mitigation Strategies

Update GPAC to the latest version to patch the heap buffer overflow in stbl_AddSize. Avoid processing untrusted MP4 files until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-55640. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart