CVSS 8.8 Heap Overflow in GPAC MP4Box Exposes Users to Remote Code Risks

A heap-based buffer overflow in GPAC’s MP4Box utility, tracked as CVE-2025-55640, exposes users to significant security risks when processing malicious media files. The flaw resides in the stbl_AddSize function and is triggered when the tool imports a crafted MP4 file containing manipulated sample metadata. This issue was reported by Alexander A. Shvedov and posted to the oss-security mailing list in the fourth quarter of 2026.

The vulnerability allows an attacker to exploit the memory handling of the application. According to the official advisory, the specific vector involves corrupted sample counts within the media container. This type of flaw can lead to unpredictable behavior, including crashes or potentially more severe outcomes, depending on the environment and the specific data injected.

What is the severity and impact?

The flaw is rated HIGH with a CVSS 3.1 base score of 8.8. The vector string indicates network-based access with low complexity and no privileges required. However, user interaction is required to trigger the event. The impact metrics for confidentiality, integrity, and availability are all rated HIGH. This suggests that a successful exploit could significantly compromise the system’s state and data integrity.

The high impact scores reflect the potential for the heap overflow to disrupt normal operations or leak sensitive information. Because the attack requires a user to open or process the crafted file, the initial barrier is the user’s action. Once the file is processed by MP4Box, the exploit chain begins.

Which versions are affected?

The advisory identifies the affected product as GPAC, specifically the MP4Box component. The vulnerability exists in all versions prior to the fix commit 321624f28d19a413449fd1718d1eb59037f8f7fc. Users running builds before this specific commit are exposed to the risk. There is no mention of specific version numbers in the advisory, only the commit hash that resolves the issue.

This means that organizations and individuals using pre-commit builds or older releases of the tool must verify their current status. The lack of version numbers requires checking the build history or source control status against the provided commit hash to determine exposure.

How does the attack work?

The attack relies on a crafted MP4 file. The file contains corrupted sample metadata, specifically manipulated sample counts. When MP4Box imports this file, the stbl_AddSize function processes the metadata incorrectly. This leads to a heap buffer overflow, where data is written beyond the allocated memory boundary.

The overflow occurs during the import process. The attacker does not need authentication or special privileges on the target system. The only requirement is that the victim uses MP4Box to open or convert the malicious MP4 file. The user interaction requirement limits the scope of automated attacks but remains a significant risk in environments where users process untrusted media.

What is the current status?

A fix has been identified in the source code, represented by the commit hash 321624f28d19a413449fd1718d1eb59037f8f7fc. The advisory does not specify if a binary patch or updated package is available for all platforms. Users must apply the code fix or upgrade to a build that includes this commit.

Until the fix is applied, users should avoid processing untrusted MP4 files with MP4Box. The vulnerability is well-documented in the advisory, providing clear guidance on the affected function and the nature of the input that triggers the overflow.

Detection notes

Teams usually monitor for unexpected process crashes or memory access violations in media processing tools. Check whether MP4Box is being used in automated pipelines that handle untrusted input. Look for alerts related to heap corruption or abnormal memory usage during file imports. The first containment move is to stop the processing of suspicious media files. Isolate systems that have processed crafted inputs to prevent lateral movement. Verify that the application is running in a restricted environment with minimal privileges to limit the blast radius of any potential overflow.

Background: Buffer overflow vulnerabilities

A buffer overflow vulnerability causes a crash or exploit when a program writes more data into a fixed-size memory buffer than it can hold. This overwrites adjacent memory, including return addresses. Attackers manipulate this overflow to inject malicious code or redirect execution. The root cause is missing bounds checking during data input or processing.

Read the full guide: What Causes a Buffer Overflow Vulnerability: The Memory Logic Breakdown

What to do and how to stay safe: GPAC

• Verify your GPAC build against the fix commit 321624f28d19a413449fd1718d1eb59037f8f7fc to ensure you are not running vulnerable code.
• Avoid using MP4Box to open or convert MP4 files from untrusted sources until a patched version is deployed.
• Implement sandboxing or restricted execution environments for media processing tools to limit the impact of potential exploits.
• Monitor system logs for crashes or memory errors associated with MP4Box that could indicate an attempted exploitation.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2025-55640?

CVE-2025-55640 is a heap-based buffer overflow in GPAC MP4Box triggered by crafted MP4 files with corrupted sample metadata.

Is user interaction required for exploitation?

Yes, the CVSS vector indicates that user interaction is required to trigger the vulnerability.

What is the CVSS score for this flaw?

The flaw has a CVSS 3.1 score of 8.8, which is rated as HIGH severity.