What is the CVSS score of CVE-2025-55644?

CVE-2025-55644 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of GPAC MP4Box are affected by CVE-2025-55644?

A critical use-after-free vulnerability in GPAC MP4Box allows arbitrary code execution when processing specially crafted MP4 files; no public exploit has been identified at time of analysis.

How to fix or mitigate CVE-2025-55644?

24 hours: Inventory all systems running GPAC MP4Box; restrict processing to trusted MP4 sources only and implement file origin validation. 7 days: Deploy containerization or sandboxing for any remaining GPAC processing; segment MP4 processing nodes from production networks and sensitive systems. 30 days: Evaluate migration to alternative media processing libraries with active patch support; establish vendor communication plan to track GPAC patch release timeline.

GPAC MP4Box CVE-2025-55644

EUVD-2025-210144 MEDIUM

Use After Free (CWE-416)

2026-06-13

GHSA-2j29-6f2f-79fx

Denial Of Service Memory Corruption Use After Free Gpac

5.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

8.8 HIGH

Network-deliverable crafted file, no privileges required, but user must open it; UAF yields full memory corruption impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 21:22 NVD

CRITICAL MEDIUM

CVSS changed

Jun 15, 2026 - 21:22 NVD

5.5 (CRITICAL) 5.5 (MEDIUM)

Analysis Generated

Jun 13, 2026 - 20:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Use-After-Free Memory Corruption in OpenSSL - CVE-2025-55644 Jun 13, 2026

AnalysisAI

Use-after-free memory corruption in GPAC's MP4Box triggers via gf_node_get_tag when parsing a crafted MP4 file containing an invalid BIFS GlobalQuantizer command. Any user or automated pipeline processing an attacker-supplied MP4 file with an affected GPAC build is exposed. Exploitation could yield arbitrary code execution or a reliable crash, depending on heap layout at the time of the free. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for MP4 file packaging, inspection, and scene graph manipulation. MP4Box is its primary command-line interface. BIFS (Binary Format for Scenes) is the ISO/IEC 14496-11 binary encoding of MPEG-4 scene graphs; the GlobalQuantizer command within BIFS sets floating-point quantization parameters applied to subsequent scene nodes. The vulnerability resides in gf_node_get_tag, a function that retrieves the type tag of a scene-graph node pointer. An invalid GlobalQuantizer command can trigger premature freeing of a node object; a subsequent call to gf_node_get_tag then dereferences the freed pointer, producing a classic CWE-416 (Use After Free) condition. No CPE strings were supplied in the source data, so exact affected version ranges have not been independently confirmed. CWE is not explicitly stated in the advisory but the UAF class is unambiguous from the oss-security subject line.

RemediationAI

No vendor-released patch version has been identified in the available source data. Consumers should monitor the GPAC GitHub repository for a tagged release or commit that addresses CVE-2025-55644 and upgrade as soon as one is available. As a compensating control, avoid processing untrusted or externally-sourced MP4 files with MP4Box or any application linking libgpac until a patch is confirmed. If GPAC is deployed in a server-side media pipeline, restrict file ingestion to validated, trusted sources and add process-level sandboxing (e.g., seccomp, AppArmor, or container isolation) to limit the blast radius of a successful UAF exploit. Running MP4Box under a low-privilege user without write access to sensitive paths reduces the impact of code execution. See https://seclists.org/oss-sec/2026/q2/903 for the original disclosure.