What is the CVSS score of CVE-2025-55643?

CVE-2025-55643 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

GPAC MP4Box CVE-2025-55643

EUVD-2025-210143 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-15 mitre

GHSA-v7rj-wmp7-c87g

Denial Of Service Null Pointer Dereference N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local file-based trigger with mandatory user interaction; impact is crash-only DoS - no confidentiality or integrity consequence applies.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:19 vuln.today

CVSS changed

Jun 15, 2026 - 21:22 NVD

5.5 (None) 5.5 (MEDIUM)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

AnalysisAI

NULL pointer dereference in GPAC MP4Box v2.4 crashes the application when processing a specially crafted MP4 file, delivering a denial of service against any user or automated pipeline invoking the tool. The flaw is isolated to the TrackWriter handling component in filters/mux_isom.c, triggered by malformed MP4 input that causes an unvalidated pointer dereference. No public exploit code has been identified and this CVE does not appear in CISA KEV; SSVC rates exploitation status as none with no automation potential, consistent with a limited, file-delivery-dependent attack surface.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for packaging, editing, and inspecting ISO Base Media File Format (ISOBMFF/MP4) containers; MP4Box is its primary command-line tool. The vulnerability resides in filters/mux_isom.c within the TrackWriter component, which handles track multiplexing during MP4 container construction and writing. CWE-476 (NULL Pointer Dereference) identifies the root cause class: a pointer is consumed without being validated for NULL, causing an access violation and process crash when malformed or structurally abnormal MP4 input causes an expected object reference to be absent - a pattern common in media demuxers and remuxers when crafted files bypass normal initialization paths. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-specific and unusable for automated asset inventory queries; defenders must match directly against the explicit product and version string from the CVE description.

RemediationAI

No vendor-released patch version is confirmed from the available references. The primary technical references point to an oss-security mailing list post (http://www.openwall.com/lists/oss-security/2026/06/13/5) and a researcher post on infosec.exchange - neither confirms a tagged patched release. Patch availability per vendor advisory should be monitored directly in the GPAC project repository targeting filters/mux_isom.c. As a compensating control, organizations running automated MP4 processing pipelines should sandbox or containerize MP4Box invocations so that a process crash does not propagate to dependent services - note that sandboxing adds latency and operational overhead. Implement process watchdog/restart logic with alerting on abnormal termination to detect repeated crash attempts. Restrict ingestion of untrusted MP4 files into any pipeline invoking GPAC MP4Box 2.4 until a confirmed fix version is available from the vendor.