EUVD-2025-210141
GHSA-63vp-58qx-xx8w
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File delivered over network (AV:N), user must invoke MP4Box on it (UI:R), crash is application-only with no C/I impact (A:L, S:U, C:N, I:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
NULL pointer dereference in GPAC's MP4Box crashes the application when importing a crafted MP4 file containing corrupted Sample Auxiliary Information (SAI) metadata with an invalid sai_samples count. The function gf_isom_copy_sample_info() in isomedia/isom_write.c:8164 fails to validate pointers after SAI merge handling fails, resulting in a SEGV read at address 0x0 and an application crash. A publicly available proof-of-concept MP4 file exists on GitHub; however, this CVE is not in CISA KEV, and exploitation is constrained to a denial-of-service (process crash) with no code execution or data exposure demonstrated.
Technical ContextAI
GPAC is an open-source multimedia framework; MP4Box is its primary command-line tool for ISO Base Media File Format (ISOBMFF) manipulation including track import, remuxing, and splitting. The vulnerable function gf_isom_copy_sample_info() resides in isomedia/isom_write.c and is responsible for copying Sample Auxiliary Information (SAI) - metadata structures defined in the ISOBMFF specification that carry per-sample auxiliary data such as encryption info. CWE-476 (NULL Pointer Dereference) describes the root cause: when the SAI merge step encounters an invalid sai_samples count and fails, the function does not guard subsequent pointer dereferences, leading to a read from address 0x0. The crash call stack traverses gf_import_isomedia() → gf_import_isomedia_track() → gf_isom_copy_sample_info(), meaning the flaw is reached specifically during track import operations. The affected codebase is gpac/gpac on master prior to commit f87b30611380e4dcd03cd4dd9ac553c0ec336826. No CPE string was provided in the available input data; exact release version boundaries are not independently confirmed.
RemediationAI
The upstream fix is available as commit f87b30611380e4dcd03cd4dd9ac553c0ec336826 in the gpac/gpac repository; however, a tagged GPAC release incorporating this patch has not been independently confirmed from the available data, so this should be treated as an upstream fix available via source rather than a vendor-released versioned patch. Users building GPAC from source should update to a revision at or after this commit. For operators who cannot immediately rebuild, the primary compensating control is to restrict MP4Box input to files sourced exclusively from trusted, pre-validated origins - do not pass user-supplied or third-party MP4 files directly to MP4Box import operations. In automated pipelines, adding a pre-screening step that rejects MP4 files with malformed SAI boxes (e.g., using a separate validator or sandboxed parsing pass) can prevent the vulnerable code path from being reached; the trade-off is added pipeline latency and the need to maintain a separate parsing component. Sandboxing the MP4Box process (e.g., with seccomp or a container with limited restart policy) limits the blast radius of a crash to the isolated process rather than the broader service. The oss-security advisory is at https://seclists.org/oss-sec/2026/q2/909 and the upstream issue at https://github.com/gpac/gpac/issues/3195.
More from same product – last 7 days
Divide-by-zero in GPAC's MP4Box AVI demuxer crashes the process when handling crafted media files with zero-declared fra
Heap-based buffer overflow in GPAC MP4Box (all versions prior to fix commit 61bbfd2e89553373ba3449b8ec05b5f098d732a5) al
NULL pointer dereference in GPAC's MP4Box fragmentation pipeline allows unauthenticated remote attackers to crash the ap
Use-after-free memory corruption in GPAC's MP4Box triggers via gf_node_get_tag when parsing a crafted MP4 file containin
Heap use-after-free in GPAC MP4Box's MPEG-4 LASeR/SVG processing path crashes the tool when parsing a crafted MP4 file w
Share
External POC / Exploit Code
Leaving vuln.today