What is the CVSS score of CVE-2025-55639?

CVE-2025-55639 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2025-55639?

Yes, a public proof-of-concept exploit is available for CVE-2025-55639. Prioritise patching immediately. EPSS: 0.3%.

GPAC MP4Box CVE-2025-55639

EUVD-2025-210311 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-23 mitre

GHSA-hr6c-43h9-9ghm

Null Pointer Dereference Denial Of Service N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

File delivered over network but user must invoke MP4Box; crash-only impact means C:N/I:N; no scope change and no privileges required.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 21:05 vuln.today

Analysis Generated

Jul 22, 2026 - 21:05 vuln.today

CVE Published

Jun 23, 2026 - 00:00 cve.org

MEDIUM 6.5

CVE Published

Jun 23, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

NULL pointer dereference in GPAC MP4Box v2.4 crashes the process when parsing a specially crafted MP4 file, enabling a denial-of-service condition against any user or pipeline invoking the tool. The root cause in gf_isom_add_track_kind() is an unchecked pass of a NULL schemeURI argument to gf_strdup(), confirmed by the upstream commit diff. A proof-of-concept MP4 file is publicly available; EPSS at 0.33% and absence from CISA KEV indicate low widespread exploitation probability despite the public PoC.

Technical ContextAI

GPAC is an open-source multimedia framework; MP4Box is its command-line ISO Base Media File Format (ISOBMFF) processing tool. The vulnerable function gf_isom_add_track_kind() in src/isomedia/isom_write.c attaches track kind metadata (schemeURI strings) to MP4 track boxes. CWE-476 (NULL Pointer Dereference) is the root cause: prior to the fix, ptr->schemeURI = gf_strdup(schemeURI) was called unconditionally - when a crafted MP4 supplies a NULL schemeURI, gf_strdup() dereferences a null pointer and the process segfaults. The upstream commit 027ce139dda498ee95df36db9f9f6f3cadce8ec9 resolves this by wrapping the call in if (schemeURI). The NVD CPE is listed as cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*, which provides no useful automated scanner matching and confirms this entry was not fully enriched by NVD at time of analysis.

RemediationAI

An upstream source-level fix is available via GPAC commit 027ce139dda498ee95df36db9f9f6f3cadce8ec9 (https://github.com/gpac/gpac/commit/027ce139dda498ee95df36db9f9f6f3cadce8ec9); a tagged patched release version has not been independently confirmed at time of analysis, so users should build from the patched HEAD or monitor the GPAC releases page for an official version announcement. As an immediate compensating control for automated pipelines, restrict MP4Box from processing untrusted or externally supplied MP4 files - this eliminates the attack surface without code changes, though it may break legitimate ingest workflows. Running MP4Box inside a sandbox (e.g., Docker, bubblewrap, or seccomp) limits the blast radius of a crash to the container rather than the host process. A crash in a sandboxed worker restarts automatically, reducing operational DoS impact significantly.