EUVD-2025-210146
GHSA-44vh-hwch-5r66
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered file triggers crash only with active user interaction; no confidentiality or integrity impact, process-level availability loss only.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Integer overflow in GPAC's MP4Box causes an out-of-memory crash when processing crafted MP4 files with malformed Protection System Specific Header (PSSH) metadata during DASH segmentation. The function mp4_mux_cenc_insert_pssh() in filters/mux_isom.c fails to validate attacker-controlled kid_count and dataSize fields before using them in a buffer size calculation, causing realloc() to request approximately 61 GB (0xe40000100 bytes), which crashes the process. A public proof-of-concept MP4 file is available on GitHub; no active exploitation has been confirmed and no CISA KEV listing exists. The CVSS 3.1 score of 4.3 MEDIUM reflects the user-interaction requirement and limited availability impact.
Technical ContextAI
GPAC is an open-source multimedia framework widely used for MP4/ISOBMFF file manipulation and MPEG-DASH packaging. MP4Box is its command-line tool. The vulnerability resides in the CENC (Common Encryption) PSSH (Protection System Specific Header) muxing logic within filters/mux_isom.c. CWE-190 (Integer Overflow or Wraparound) describes the root cause: attacker-controlled size fields (kid_count, dataSize) embedded in the MP4 file's PSSH box are consumed by mp4_mux_cenc_insert_pssh() without bounds checking. The arithmetic used to calculate the buffer allocation size overflows a fixed-width integer type, producing a very large (but arithmetically valid from the CPU's perspective) value, which is then passed directly to realloc(). The affected code path is exercised specifically during DASH segmentation (mp4_mux_start_fragment()). AddressSanitizer confirms the crash at mux_isom.c:4326 with an allocation request of 0xe40000100 bytes. The fix is present in upstream commit e95f3064d846e4606276fff111e0f97df1576a04.
RemediationAI
The upstream fix is available as commit e95f3064d846e4606276fff111e0f97df1576a04 in the GPAC GitHub repository (https://github.com/gpac/gpac). Users building GPAC from source should pull and rebuild from at least this commit. A patched tagged release version has not been independently confirmed from the available data - monitor the GPAC GitHub releases page for an official versioned release incorporating this fix. As a compensating control where patching is not immediately possible, avoid processing untrusted or externally sourced MP4 files with the -dash segmentation flag. If MP4Box is used in an automated media processing pipeline, run it inside a sandboxed process (e.g., seccomp, Docker with memory limits) so that an OOM crash cannot affect the broader service. Restricting the maximum file size accepted from external sources may reduce exposure but will not prevent exploitation of files within typical size bounds.
More from same product – last 7 days
Divide-by-zero in GPAC's MP4Box AVI demuxer crashes the process when handling crafted media files with zero-declared fra
Heap-based buffer overflow in GPAC MP4Box (all versions prior to fix commit 61bbfd2e89553373ba3449b8ec05b5f098d732a5) al
NULL pointer dereference in GPAC's MP4Box fragmentation pipeline allows unauthenticated remote attackers to crash the ap
NULL pointer dereference in GPAC's MP4Box crashes the application when importing a crafted MP4 file containing corrupted
Use-after-free memory corruption in GPAC's MP4Box triggers via gf_node_get_tag when parsing a crafted MP4 file containin
Share
External POC / Exploit Code
Leaving vuln.today