Executive brief
GPAC MP4Box, a popular tool for manipulating multimedia files like MP4s, is vulnerable to a crash when processing specially crafted or corrupted video files. If a user or automated system attempts to process a malicious file, the application will terminate unexpectedly. This can lead to a denial-of-service, disrupting media processing workflows or automated content pipelines.
Technical details
A NULL pointer dereference exists in GPAC MP4Box within the `gf_media_map_esd` function in `media_tools/isom_tools.c`. When the parser encounters truncated MP4 files containing unknown or invalid `stsd` (sample description) entries, certain descriptor fields such as codec, MIME, or profile strings may fail to initialize. The application subsequently calls `strlen()` on these uninitialized NULL pointers, resulting in a segmentation fault (ASan SEGV). This is a local vulnerability requiring the victim to open or process a malformed file using MP4Box. While primarily a denial-of-service issue, it highlights a lack of validation for mandatory descriptor fields during media mapping.
Affected products
- GPAC GPAC MP4Box All versions prior to fix (issue reported Sep 2025)
Timeline
- 2025-09-23: disclosed: Issue reported on GPAC GitHub repository
- 2026-05-27: advisory: CVE-2025-70116 published to NVD