Executive brief
A vulnerability in the GPAC MP4Box utility, a tool used for processing and packaging multimedia files, can lead to a service crash. By tricking a user into processing a specially crafted MP4 file, an attacker can cause the application to terminate unexpectedly. This results in a denial of service, potentially disrupting automated media processing workflows or content delivery pipelines.
Technical details
A segmentation violation (SEGV) exists in the gf_isom_apple_set_tag_ex function within isomedia/isom_write.c of GPAC/MP4Box. The vulnerability is triggered when the application processes MP4 files containing invalid MPEG-4 descriptors (specifically corrupted 'esds' boxes) and incomplete box structures. The root cause is a failure to validate pointer correctness before accessing memory, leading to a NULL pointer dereference. An attacker can exploit this by providing a malformed MP4 file to the MP4Box utility, resulting in a crash (Denial of Service). The issue was addressed in version 26.02.0 and specifically patched in commit 4860a1a.
Affected products
- GPAC GPAC Project/MP4Box before 26.02.0
Timeline
- 2025-08-13: disclosed: Issue reported on GitHub
- 2026-06-01: advisory: CVE published to NVD