Executive brief
GPAC MP4Box, a widely used tool for processing and packaging multimedia files, is vulnerable to a crash when handling specifically malformed MP4 files. An attacker could provide a corrupted video file to a user or automated system, causing the application to stop responding or shut down unexpectedly. This primarily impacts the availability of media processing workflows and services that rely on GPAC for file conversion.
Technical details
A stack-based buffer overflow exists in GPAC MP4Box v2.4 within the gf_opus_read_length function located in media_tools/av_parsers.c. The vulnerability is triggered when the parser processes a specially crafted MP4 file containing Opus audio metadata with an invalid length field. An attacker can exploit this by providing a malicious file to the utility, leading to a stack exhaustion or corruption that results in an application crash (Denial of Service). This is a local attack vector requiring the victim to open or process the malicious file using the affected MP4Box version.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory