Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

GPAC MP4Box NULL dereference in dump_isom_saps (CVE-2025-55667)

Original title: CVE-2025-55667: NULL pointer dereference in GPAC/MP4Box dump_isom_saps via crafted MP4 input

oss-security ()1 · 1 read
Read at seclists.org
Part of a story covered by 3 sourcesEleven GPAC MP4Box bugs posted; two still lack named fixesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A local crash in build 2.5-DEV-rev1672 is fixed in commit e6d01820 and rated CVSS 5.5.

Alexander A. Shvedov reported a NULL pointer dereference in GPAC's MP4Box function dump_isom_saps, CVE-2025-55667, triggered by crafted MP4 input. It affects GPAC/MP4Box 2.5-DEV-rev1672-gc9a31d0e1-master, reproduced at commit c9a31d0e1, and is fixed in e6d01820d7bf3967d931fedb379ee5f209bc133b. A BDU assessment rates it CVSS 3.1 5.5 medium, local, with high availability impact only.

Unconfirmed: The description is cut off, and the post does not say whether the flaw is exploited.

Key facts
  • The weakness is CWE-476, NULL pointer dereference.
  • The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
  • The reproduced commit is c9a31d0e1b649a30814c6d81c5461859ed63d075.
  • The report was posted to oss-security on October 20.
Security assessment · AI, from the article

Impact: Local NULL dereference crash of MP4Box

ProductAffectedFixed in
GPAC MP4Box2.5-DEV-rev1672-gc9a31d0e1-master, commit c9a31d0e1b649a30814c6d81c5461859ed63d075e6d01820d7bf3967d931fedb379ee5f209bc133b
What to do
  1. 1.Update GPAC MP4Box to commit e6d01820d7bf3967d931fedb379ee5f209bc133b.
Analyze CVE-2025-55667 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2025-55667
Tags
gpacmp4boxnull-dereferencemp4denial-of-service
Vendors
GPAC
Products
MP4Box

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2025-55667
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a…
5.5—

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha1c9a31d0e1b649a30814c6d81c5461859ed63d075Box 2.5-DEV-rev1672-gc9a31d0e1-master; reproduced at commit c9a31d0e1b649a30814c6d81c5461859ed63d075 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-20
sha1e6d01820d7bf3967d931fedb379ee5f209bc133bd at commit c9a31d0e1b649a30814c6d81c5461859ed63d075 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-2025-55667 CWE: CWE-476 (NULL Pointer Dereference)

From the original article

Posted by Alexander A. Shvedov on Oct 20 Product: GPAC (MP4Box) Affected: GPAC/MP4Box 2. 5-DEV-rev1672-gc9a31d0e1-master; reproduced at commit c9a31d0e1b649a30814c6d81c5461859ed63d075 Fixed: e6d01820d7bf3967d931fedb379ee5f209bc133b CVE: CVE-2025-55667 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.