Executive brief
GPAC MP4Box is a popular open-source tool used for processing and packaging multimedia files like MP4s. A security flaw in how it handles Opus audio headers allows a specially crafted video file to crash the application. This could lead to a denial-of-service, interrupting media processing workflows or automated content pipelines.
Technical details
A heap-based buffer overflow exists in GPAC MP4Box v2.4 within the gf_opus_parse_packet_header function located in media_tools/av_parsers.c. The vulnerability is triggered when the application attempts to parse a malformed Opus audio packet header inside an MP4 container. An attacker can exploit this by providing a specially crafted MP4 file to the utility. Successful exploitation results in a memory corruption that leads to an application crash (Denial of Service). While primarily a DoS risk, heap overflows can sometimes be leveraged for further exploitation depending on the environment.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed: Initial disclosure and NVD publication