CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
CVE-2025-55640 is a heap overflow in GPAC MP4Box triggered by crafted MP4 sample metadata.
Alexander A. Shvedov reported CVE-2025-55640, a heap buffer overflow in GPAC's MP4Box. Importing a crafted MP4 with manipulated sample metadata, including corrupted sample counts, can trigger the overflow in stbl_AddSize. The oss-security post is a vulnerability disclosure; it does not report in-the-wild exploitation.
- CVE-2025-55640 is a heap buffer overflow in GPAC's MP4Box.
- A crafted MP4 with corrupted sample metadata triggers it via stbl_AddSize.
- The report describes a parsing flaw, not observed exploitation.
- CVEs
- CVE-2025-55640
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55640 | Heap buffer overflow DoS in GPAC MP4Box 2.4 | 5.5 | — |
From the original article
Posted by Alexander A. Shvedov on Oct 17 Product: GPAC (MP4Box) https://infosec. exchange/@sigdevel> Description: When MP4Box imports a crafted MP4 file containing manipulated sample metadata (corrupted sample counts,...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.