Denial of Service Vulnerability in GPAC MP4Box Software by GPAC
CVE-2025-55654

5.5MEDIUM

Key Information:

Vendor

GPAC

Status
GPAC MP4Box
Vendor
CVE Published:
19 October 2026

What is CVE-2025-55654?

A use-after-free vulnerability exists in the gf_filter_pid_get_packet function within GPAC MP4Box v2.4. This flaw enables attackers to create a Denial of Service (DoS) condition by submitting a specially crafted file. Exploiting this vulnerability could disrupt normal operation, leading to service outages for users. Proper validation and safe handling of memory resources are required to mitigate this risk.

References

https://github.com/gpac/gpac/issues/3249
https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352...
https://infosec.exchange/@sigdevel/116769098607015606

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.