Executive brief
A vulnerability in the GPAC MP4Box media processing tool can cause the application to crash when handling specifically modified video files. MP4Box is widely used for manipulating multimedia files like MP4s; an exploit could allow an attacker to disrupt media processing workflows or cause a denial-of-service. This occurs when the software encounters inconsistent data within a video file, leading to an immediate failure of the program.
Technical details
A NULL pointer dereference vulnerability exists in the gf_media_get_color_info function within media_tools/isom_tools.c of GPAC. The issue is triggered when processing a crafted MP4 file where a video sample entry is inconsistent with its contained boxes (e.g., a v210 entry incorrectly containing an avcC AVC Decoder Configuration Box). This inconsistency causes gf_isom_avc_config_get or gf_isom_hevc_config_get to return a NULL pointer, which is subsequently dereferenced without validation. An attacker can exploit this by providing a malicious file to the MP4Box utility, resulting in a segmentation fault and application crash. The vulnerability was addressed in commit 9beed3c by adding proper NULL checks for AVC and HEVC configurations.
Affected products
- GPAC GPAC Project/MP4Box before 26.02.0
Timeline
- 2025-09-09: disclosed: Issue reported on GitHub
- 2026-06-01: advisory: CVE published by NVD/MITRE