GPAC MP4Box 2.4 use-after-free via crafted NHML input (CVE-2025-55654)
Original title: CVE-2025-55654: Use-after-free in GPAC/MP4Box gf_filter_pid_get_packet via crafted NHML export input
Impact is availability only: a local, low-privilege use-after-free scored CVSS 5.5 and fixed at commit 0ccd2927.
Alexander A. Shvedov reported a heap use-after-free in GPAC/MP4Box, CVE-2025-55654, triggered through crafted NHML export input in gf_filter_pid_get_packet. GPAC/MP4Box 2.4 is affected, and the bug was reproduced at two named commits. The stated fix is commit 0ccd2927c7145f5ab0352c5b15f787757b34eb18. The BDU CVSS 3.1 score is 5.5 Medium, with high impact limited to availability.
Unconfirmed: The feed snippet cuts off the heap-bug description.
- The weakness is CWE-416, use after free.
- It was reproduced at commits 63eccc33 and 0ab2af43.
- The vector is local, low complexity, and requires low privileges.
- No confidentiality or integrity impact is scored.
Impact: Local use-after-free causing denial of service
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | GPAC/MP4Box 2.4 | 0ccd2927c7145f5ab0352c5b15f787757b34eb18 |
- 1.Update GPAC to commit 0ccd2927c7145f5ab0352c5b15f787757b34eb18 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55654 | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 0ab2af43da6b89a556ce52086057d1812ceade9e | ced at commits 63eccc33d4a2b731ebb31581ff5673a2c0b13ad4 and 0ab2af43da6b89a556ce52086057d1812ceade9e Fixed: 0ccd2927c7145f5ab0352c5b15f787757b34eb18 CVE: CVE-20 |
| sha1 | 0ccd2927c7145f5ab0352c5b15f787757b34eb18 | 0b13ad4 and 0ab2af43da6b89a556ce52086057d1812ceade9e Fixed: 0ccd2927c7145f5ab0352c5b15f787757b34eb18 CVE: CVE-2025-55654 CWE: CWE-416 (Use After Free) CVSS 3.1: |
| sha1 | 63eccc33d4a2b731ebb31581ff5673a2c0b13ad4 | C (MP4Box) Affected: GPAC/MP4Box 2.4; reproduced at commits 63eccc33d4a2b731ebb31581ff5673a2c0b13ad4 and 0ab2af43da6b89a556ce52086057d1812ceade9e Fixed: 0ccd292 |
From the original article
Posted by Alexander A. Shvedov on Oct 20 Product: GPAC (MP4Box) Affected: GPAC/MP4Box 2. 4; reproduced at commits 63eccc33d4a2b731ebb31581ff5673a2c0b13ad4 and 0ab2af43da6b89a556ce52086057d1812ceade9e Fixed: 0ccd2927c7145f5ab0352c5b15f787757b34eb18 CVE: CVE-2025-55654 CWE: CWE-416 (Use After Free) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.