CVE-2025-55667 Details
Description
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A segmentation violation vulnerability has been identified in GPAC MP4Box version 2.5-DEV-rev1672-gc9a31d0e1-master. The issue arises in the dump_isom_saps function within the file applications/mp4box/filedump.c. This vulnerability allows attackers to cause a denial-of-service (DoS) condition by supplying a crafted MP4 file that lacks a valid Sample Description box (stsd). When the function processes such corrupted track structures, it attempts to access invalid memory locations, leading to a crash.
Users should update to a version of GPAC MP4Box that includes the fix for this vulnerability. The fix is available in the GPAC commit 'e6d01820d7bf3967d931fedb379ee5f209bc133b'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gpac/gpac/issues/3321 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743 | CISA-ADP | Exploit |
| http://www.openwall.com/lists/oss-security/2026/10/20/8 | CVE | |
| https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b | [email protected] | Source CodeVendor |
| https://github.com/gpac/gpac/issues/3321 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743 | [email protected] | Exploit |
| https://infosec.exchange/@sigdevel/117456648463009125 | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| GPAC MP4Box | 2.5-DEV-rev1672-gc9a31d0e1-master |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Translated | [email protected] |
| Oct 20, 2026 | CVE Modified | CVE |
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |