Heap Buffer Overflow in GPAC MP4Box Affects Media Parsing Capabilities
CVE-2025-55648

5.5MEDIUM

Key Information:

Vendor

GPAC

Status
MP4Box
Vendor
CVE Published:
15 June 2026

What is CVE-2025-55648?

The GPAC MP4Box version 2.4 has a critical vulnerability in the gf_opus_parse_packet_header function, which can lead to a heap buffer overflow. By providing a specially crafted MP4 file, an attacker can manipulate memory allocation. This flaw can cause abnormal termination of the media processing service, resulting in a Denial of Service condition. It highlights the importance of rigorous input validation in media applications to safeguard against potentially harmful exploits.

References

https://infosec.exchange/@sigdevel/116736751244916557

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.