What is the CVSS score of CVE-2025-52293?

CVE-2025-52293 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GPAC MP4Box are affected by CVE-2025-52293?

GPAC MP4Box v2.4 contains a remote denial-of-service vulnerability (CVE-2025-52293) allowing attackers to crash the application by supplying malicious video files.

How to fix or mitigate CVE-2025-52293?

Within 24 hours: inventory all systems running GPAC MP4Box v2.4 and determine operational criticality. Within 7 days: restrict network access via firewall rules; isolate instances from untrusted networks. Within 30 days: contact GPAC project for patch timelines; evaluate alternative media processing libraries or implement input validation controls for HEVC Sequence Parameter Set (SPS) parsing.

GPAC MP4Box CVE-2025-52293

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 mitre

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:25 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.

AnalysisAI

Denial of service in GPAC MP4Box v2.4 allows remote attackers to crash the application by supplying a crafted HEVC Sequence Parameter Set (SPS), triggering a segmentation violation in the gf_hevc_read_sps_bs_internal function within media_tools/av_parsers.c. No public exploit identified at time of analysis, though the bug is reachable without authentication or user interaction per the CVSS vector. Real-world impact is limited to availability of the parsing process, with no integrity or confidentiality consequences.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for packaging, streaming, and analyzing MP4/ISOBMFF and related container formats; MP4Box is its command-line packaging utility. The defect resides in the HEVC (H.265) SPS bitstream parser implemented in media_tools/av_parsers.c, where malformed values in the Sequence Parameter Set lead to a segmentation violation. The associated CWE-400 (Uncontrolled Resource Consumption) classification points to the parser failing to constrain or validate fields before dereferencing or allocating based on them, allowing a malformed SPS to abort the process.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - users should monitor the upstream GPAC repository (github.com/gpac/gpac) and the project's release notes for a fixed build superseding 2.4, then upgrade once an advisory is published. As compensating controls, avoid passing untrusted or attacker-controlled HEVC/MP4 inputs to MP4Box in automated pipelines; where MP4Box runs as a service, wrap invocations in a supervised sandbox (systemd restart policy, container with restart-on-crash, or a job queue that isolates failures) so a single crafted SPS only kills the worker rather than the parent service, and restrict the binary's filesystem and network capabilities via seccomp/AppArmor. Pre-validating HEVC streams with a hardened decoder before handing them to MP4Box reduces exposure but adds processing latency and may reject otherwise-valid files.