Executive brief
GPAC MP4Box is a popular multimedia packager used to process and edit video files. A vulnerability in how it handles specific file data allows an attacker to crash the application by providing a specially crafted MP4 file. This results in a denial-of-service, potentially disrupting automated video processing workflows or media management systems.
Technical details
A NULL pointer dereference vulnerability exists in GPAC MP4Box v2.4 within the gf_isom_copy_sample_info function located in isomedia/isom_write.c. The flaw is triggered when the application attempts to access a memory address that is NULL during the processing of sample information from a malformed MP4 file. An attacker can exploit this by providing a specially crafted MP4 file to the utility, leading to an immediate application crash (Denial of Service). This is a local attack vector requiring the victim to process the malicious file. No authentication is required to trigger the crash beyond the ability to submit a file for processing.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed: CVE published to NVD