Executive brief
A vulnerability exists in GPAC MP4Box, a popular multimedia framework used for processing and packaging video files. By providing a specially crafted MP4 or MPEG-2 TS file, an attacker can cause the application to crash. This results in a denial-of-service, potentially disrupting automated video processing workflows or media delivery services.
Technical details
A heap buffer overflow exists in the m2tsdmx_send_packet function within filters/dmx_m2ts.c of GPAC MP4Box v2.4. The vulnerability is triggered when the MPEG-TS demuxer fails to validate data sizes before performing memory copy operations on corrupted packet structures. Specifically, when processing DVB subtitles, the code fails to check if the packet length is sufficient before decrementing the length and advancing the pointer, leading to an invalid large memcpy size. An attacker can exploit this by supplying a crafted MPEG-2 TS or MP4 file, resulting in an application crash (Denial of Service). A fix has been committed to the GPAC repository to validate the packet length.
Affected products
- GPAC GPAC MP4Box 2.4
Timeline
- 2025-07-22: disclosed: Issue reported on GitHub
- 2026-06-01: advisory: NVD publication date
- 2025-07-22: patched: Fix committed to GPAC repository