Executive brief
A vulnerability in GPAC MP4Box, a popular tool for processing multimedia files, allows an attacker to crash the application. By tricking a user into opening a specially crafted MP4 video file, the software may exhaust all available memory and stop functioning. This results in a denial-of-service, potentially disrupting media processing workflows or automated systems.
Technical details
An Out-of-Memory (OOM) vulnerability exists in the mp4_mux_cenc_insert_pssh function within filters/mux_isom.c of GPAC MP4Box v2.4. The flaw is triggered when the application processes a maliciously crafted MP4 file containing specific Common Encryption (CENC) metadata. An attacker can exploit this by providing a file that causes excessive memory allocation, leading to a crash or system instability (Denial of Service). This is a local attack vector requiring the victim to process the malicious file using the MP4Box utility.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed: CVE published to NVD