Executive brief
A vulnerability in the GPAC MP4Box utility, a tool used for processing and packaging multimedia files, could allow an attacker to crash the application. By tricking a user into opening a specially crafted MP4 file, an attacker can cause a denial-of-service condition. This impact is limited to the availability of the tool and does not directly result in data theft or unauthorized access.
Technical details
A NULL pointer dereference exists in GPAC MP4Box v2.4 within the ctts_box_write function located in isomedia/box_code_base.c. The vulnerability is triggered when the application attempts to write a Composition Time to Sample (ctts) box from a malformed MP4 file that lacks expected data structures. An attacker can exploit this by providing a specially crafted MP4 file to the MP4Box utility. Successful exploitation results in an immediate application crash (Denial of Service). This is a local attack vector requiring user interaction to process the malicious file.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-09: disclosed: Initial disclosure of CVE-2025-55659