What is the CVSS score of CVE-2025-52292?

CVE-2025-52292 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GPAC MP4Box are affected by CVE-2025-52292?

GPAC MP4Box v2.4 contains a denial-of-service vulnerability (CVE-2025-52292, CVSS 7.5) that enables remote attackers to crash the application by submitting crafted MP4 files, disrupting video…

How to fix or mitigate CVE-2025-52292?

Within 24 hours: Audit all systems running GPAC MP4Box v2.4 and document affected workflows and dependencies. Within 7 days: Implement strict input validation and file-type verification for all MP4 submissions; isolate MP4Box processing to sandboxed or segregated environments; disable MP4Box on internet-facing systems if possible. Within 30 days: Monitor GPAC vendor advisories for patch availability; evaluate alternative MP4 processing solutions; consider service redundancy or failover mechanisms to absorb temporary outages.

GPAC MP4Box CVE-2025-52292

HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 mitre

Denial Of Service Stack Overflow Buffer Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:25 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

AnalysisAI

Denial of service in GPAC MP4Box v2.4 allows remote attackers to crash the application by supplying a crafted MP4 file that triggers a stack buffer overflow in the filein_process function. The flaw resides in in_file.c and impacts availability only, with no confirmed code-execution path; no public exploit identified at time of analysis, though POC details may surface via the linked infosec.exchange post.

Technical ContextAI

GPAC is an open-source multimedia framework, and MP4Box is its command-line tool for packaging, inspecting, and converting ISO base media files (MP4, 3GP, etc.). The vulnerability is rooted in CWE-121 (Stack-based Buffer Overflow) within the filein_process routine of the file-input module (in_file.c), which handles reading and dispatching file data into GPAC's processing pipeline. A maliciously crafted MP4 container can cause the routine to write past a fixed-size stack buffer, corrupting the stack frame and crashing the process. Because GPAC/MP4Box is widely embedded in transcoding pipelines, media servers, and forensic toolchains, the parsing surface is broad.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; defenders should monitor the GPAC GitHub repository (github.com/gpac/gpac) for a fix to in_file.c filein_process and upgrade to the first tagged release that incorporates it. As compensating controls, restrict MP4Box to processing only trusted/authenticated content, run it inside a sandboxed or containerized worker with automatic restart so a crash does not take down the surrounding pipeline, and apply resource limits (ulimit, cgroups) to contain abnormal behavior - the trade-off is added orchestration complexity and minor latency overhead on each invocation. Pre-filtering inbound MP4 files with a lighter-weight validator (e.g., a known-good header/box-structure check) can reject obviously malformed inputs before they reach MP4Box, at the cost of false positives on edge-case but legitimate files. Additional context may be available at the referenced post: https://infosec.exchange/@sigdevel/116707273214520860.