Executive brief
GPAC MP4Box, a widely used tool for processing and packaging multimedia files, is vulnerable to a crash when processing specifically malformed MP4 files. An attacker could provide a corrupted video file to a user or automated system, causing the application to stop responding or shut down unexpectedly. This results in a denial of service, potentially disrupting media processing workflows or automated content pipelines.
Technical details
A segmentation violation (likely a NULL pointer dereference) exists in the Track_SetStreamDescriptor function within isomedia/track.c of GPAC MP4Box v2.4. The vulnerability is triggered when the application attempts to process a specially crafted MP4 file. An attacker can exploit this by providing a malicious file to the utility, leading to an application crash and a Denial of Service (DoS) condition. This is a local attack vector requiring the victim to open or process the file using the vulnerable MP4Box binary.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed: CVE published to NVD