Is there a public PoC exploit available for CVE-2025-15667?

Yes, a public proof-of-concept exploit is available for CVE-2025-15667. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2025-15667?

Yes, a patch is available for CVE-2025-15667. Update the affected software to the latest version immediately.

GPAC MP4Box CVE-2025-15667

Q: What is the CVSS score of CVE-2025-15667?

CVE-2025-15667 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-210429 LOW

Double Free (CWE-415)

2026-07-06 VulDB

GHSA-r4c4-62x2-m3ww

Information Disclosure Gpac

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.3 LOW

Local-only file processing context requires low privileges; double-free causes crash only, with no confidentiality or integrity impact supported by evidence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 12:22 vuln.today

Severity Changed

Jul 06, 2026 - 12:22 NVD

MEDIUM LOW

CVSS changed

Jul 06, 2026 - 12:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

DescriptionCVE.org

A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Double-free memory corruption in GPAC MP4Box up to version 2.5-DEV allows a local, low-privileged attacker to trigger heap corruption via a crafted MP4 file processed by the gf_isom_nalu_sample_rewrite function, resulting in low availability impact (crash). No confidentiality or integrity impact is indicated by the CVSS 4.0 vector despite the 'Information Disclosure' tag in VulDB, which appears inconsistent with the scored metrics. A public POC exists at GitHub, but no active exploitation has been confirmed and this CVE is not listed in CISA KEV.

Technical ContextAI

GPAC is an open-source multimedia framework; MP4Box is its command-line ISOBMFF/MP4 muxer and demuxer tool. The affected code path is gf_isom_nalu_sample_rewrite in src/isomedia/avc_ext.c, which handles AVC/H.264 NALU (Network Abstraction Layer Unit) sample rewriting within MP4 container tracks. CWE-415 (Double Free) occurs when the nalu_out_bs bitstream buffer object is freed more than once during NALU sample processing, causing heap metadata corruption. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms this is triggered locally with no special attack preconditions, and the vulnerable-system availability impact is low (VA:L), consistent with a crash or abort rather than arbitrary code execution. CPE cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:* covers all GPAC versions up to 2.5-DEV.

RemediationAI

Apply upstream patch commit f29f955f2a3b5e8e507caad3e52319f961bf37bf available at https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bf. This is a source-level commit, not a tagged release - organizations should build GPAC from the patched source tree or wait for an official release that incorporates this fix; a specifically versioned patched release has not been independently confirmed at time of analysis. As a compensating control, restrict execution of MP4Box to trusted users and avoid processing untrusted or externally sourced MP4 files with unpatched builds. If GPAC is used in automated media processing pipelines, sandbox the MP4Box process using seccomp profiles, Linux namespaces, or container isolation to contain the impact of heap corruption to the processing process only. Disabling NALU rewriting operations on untrusted input is not directly configurable via a standalone flag, so process isolation is the most actionable workaround.