Junglewise Threat Intelligence

CVE-2025-15667: GPAC MP4Box double free in gf_isom_nalu_sample_rewrite

CVE-2025-15667 · Severity: low · CVSS 3.3 · Published 2026-07-06

Technologies: Gpac. Vendors: Gpac.

Executive brief

GPAC is an open-source multimedia framework used for packaging and streaming video content. A vulnerability in its MP4Box component could allow a local user to cause the application to crash by processing a specially crafted MP4 file. This could lead to a denial-of-service condition, impacting the availability of media processing workflows.

Technical details

A double free vulnerability exists in the gf_isom_nalu_sample_rewrite function within src/isomedia/avc_ext.c of GPAC's MP4Box component. The issue stems from improper management of the nalu_out_bs argument during NALU sample rewriting, particularly when using the '-cat' command to concatenate media files. A local attacker can exploit this by providing a specially crafted MP4 file, leading to memory corruption and an application crash (abort). A patch has been released in commit f29f955f2a3b5e8e507caad3e52319f961bf37bf to ensure proper bitstream content handling and prevent the double free.

Affected products

  • GPAC GPAC up to 2.5-DEV

Timeline

  • 2025-11-27: disclosed: Issue reported on GitHub by TimChan2001
  • 2026-07-06: advisory: NVD publication date
  • 2025-11-27: patched: Fix committed to GPAC repository

References

Related threats