Executive brief
A vulnerability was found in GPAC, a popular open-source multimedia framework used for video streaming and transcoding. The issue exists in the MP4Box component, which is used for packaging and manipulating media files. An attacker could use a specially crafted media file to cause the application to crash, potentially leading to a denial-of-service or disruption of media processing operations.
Technical details
A heap-based buffer overflow vulnerability exists in GPAC's MP4Box component within the sgpd_del_entry function in src/isomedia/box_code_base.c. The flaw is triggered during the deletion of AV1 sample group description (sgpd) entries when processing nested ISO box structures. Specifically, an out-of-bounds read/write occurs on a buffer originally allocated in sg_av1s_create_entry. An attacker with local access can exploit this by providing a malformed MP4 file to MP4Box, leading to a crash (denial of service). A patch has been released in commit f29f955f2a3b5e8e507caad3e52319f961bf37bf.
Affected products
- GPAC GPAC up to b40ce70f5
Timeline
- 2025-11-25: disclosed: Issue reported on GitHub
- 2026-07-06: advisory: NVD publication date
References
- https://github.com/TimChan2001/pocs/raw/refs/heads/main/poc-gpac-0
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bf
- https://github.com/gpac/gpac/issues/3398
- https://vuldb.com/cve/CVE-2025-15668
- https://vuldb.com/submit/846851
- https://vuldb.com/vuln/376293