CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
CVE-2025-55640 is a heap overflow in GPAC MP4Box triggered by crafted MP4 sample metadata.
46
CVE-2025-55640
Heap buffer overflow DoS in GPAC MP4Box 2.4
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2025-55640 is a heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box 2.4. An attacker triggers it by supplying a crafted MP4 file with corrupted sample metadata. Successful exploitation crashes the process and causes a denial of service; the published description does not claim code execution or data theft. Users and automated pipelines that run MP4Box 2.4 on untrusted media are affected. It is not listed in CISA KEV, has no CVSS score yet, and no public proof-of-concept is known.
What to do: Do not process untrusted or unvalidated MP4 files with GPAC MP4Box 2.4. Upgrade to a vendor-patched release when GPAC publishes one, and until then isolate or sandbox MP4Box jobs that accept external media.
| Product | Affected |
|---|---|
| GPAC MP4Box | 2.4 |
Estimated exposure
nichethousands of developer and media-pipeline installs (order-of-magnitude estimate; no public census) — GPAC MP4Box is a specialized open-source media CLI used in developer and transcoding pipelines, not a mass consumer or internet-facing product with a published install census, so reach is estimated as niche rather than counted.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- Weakness
- CWE-122
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H