# CVE-2025-55660: GPAC MP4Box stack overflow in gf_opus_read_length

Source: https://junglewise.ai/threats/cve-2025-55660-gpac-mp4box-stack-overflow-in-gf-opus-read-length  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2025-55660 · Severity: info · Published 2026-06-15

GPAC MP4Box, a widely used tool for processing and packaging multimedia files, is vulnerable to a crash when handling specifically malformed MP4 files. An attacker could provide a corrupted video file to a user or automated system, causing the application to stop responding or shut down unexpectedly. This primarily impacts the availability of media processing workflows and services that rely on GPAC for file conversion.

Technologies: [Gpac MP4Box](https://junglewise.ai/threats/technologies/mp4box). Vendors: [Gpac](https://junglewise.ai/threats/vendors/gpac).

## Quick answers

**Is CVE-2025-55660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-55660 being exploited in the wild.

**How severe is CVE-2025-55660?** Informational severity, published 15 June 2026.

**Which products and versions are affected?** Gpac MP4Box 2.4.

**Is there a fix for CVE-2025-55660?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-55660 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-55660?** Check whether you run Gpac MP4Box at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in GPAC MP4Box v2.4 within the gf_opus_read_length function located in media_tools/av_parsers.c. The vulnerability is triggered when the parser processes a specially crafted MP4 file containing Opus audio metadata with an invalid length field. An attacker can exploit this by providing a malicious file to the utility, leading to a stack exhaustion or corruption that results in an application crash (Denial of Service). This is a local attack vector requiring the victim to open or process the malicious file using the affected MP4Box version.

## Affected products

- GPAC MP4Box 2.4

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: advisory

## References

- [https://infosec.exchange/@sigdevel/116733892068649310](https://infosec.exchange/@sigdevel/116733892068649310)

## Related threats

- [GPAC MP4Box segmentation fault in dump_isom_saps](https://junglewise.ai/threats/cve-2025-55667-a-segmentation-violation-in-the-dump-isom-saps-function-mp4box)
- [GPAC MP4Box use-after-free in gf_filter_pid_get_packet](https://junglewise.ai/threats/cve-2025-55654-a-use-after-free-in-the-gf-filter-pid-get-packet-function-filter)
- [GPAC MP4Box floating point exception in gf_parse_lfrac](https://junglewise.ai/threats/cve-2025-55653-gpac-mp4box-v2-4-was-discovered-to-contain-a-floating-point)
- [GPAC MP4Box heap buffer overflow in stbl_AddSize](https://junglewise.ai/threats/cve-2025-55640-a-heap-buffer-overflow-in-the-stbl-addsize-function-isomedia-stbl)
- [GPAC MP4Box use-after-free in gf_node_deactivate_ex](https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex)