What is the CVSS score of CVE-2025-55648?

CVE-2025-55648 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of GPAC MP4Box are affected by CVE-2025-55648?

GPAC MP4Box contains a heap buffer overflow vulnerability (CVE-2025-55648) with publicly available exploit code, enabling attackers to extract sensitive memory contents or disrupt services when a…

How to fix or mitigate CVE-2025-55648?

Within 24 hours: Identify all systems running GPAC MP4Box; restrict processing of untrusted MP4 files and disable -dxml flag where feasible. Within 7 days: Implement input validation, restrict file sources, and sandbox MP4Box execution (containers/VMs). Within 30 days: Monitor GPAC project for patch release and deploy immediately; evaluate alternative MP4 processing tools.

GPAC MP4Box CVE-2025-55648

EUVD-2025-210147 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-06-13

GHSA-pjwf-h8x2-6r9q

Buffer Overflow Denial Of Service Heap Overflow Gpac

5.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.4 MEDIUM

File deliverable over network (AV:N); victim must run MP4Box -dxml (UI:R); heap leak possible (C:L); crash confirmed (A:L); no write primitive (I:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jun 15, 2026 - 21:22 NVD

5.5 (HIGH) 5.5 (MEDIUM)

Analysis Generated

Jun 13, 2026 - 22:20 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Heap-based buffer overflow in GPAC MP4Box (all versions prior to fix commit 61bbfd2e89553373ba3449b8ec05b5f098d732a5) allows out-of-bounds heap READ when processing a crafted MP4 file containing corrupted stsz (sample-size box) data for an Opus audio track. When a user runs MP4Box with the -dxml flag against a malicious file, gf_opus_parse_packet_header() in av_parsers.c:11297 reads 1 byte beyond a 32-byte heap allocation, 1242 bytes past the base region allocated by Media_GetSample(), potentially leaking adjacent heap memory contents and crashing the process. A public proof-of-concept MP4 file is available; no active exploitation has been recorded in CISA KEV at time of analysis.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for MP4/ISOBMFF file inspection, transcoding, and packaging. The vulnerable code path is triggered during the Opus track dump operation: dump_isom_opus() → gf_inspect_dump_opus_internal() → gf_opus_parse_packet_header() (media_tools/av_parsers.c). The corrupted stsz box (ISO 14496-12 sample-size box) causes Media_GetSample() to allocate an undersized 32-byte heap buffer. gf_opus_parse_packet_header() then fails to validate the buffer boundary before parsing the Opus packet header fields (CWE-122: Heap-based Buffer Overflow), performing a READ 1242 bytes past the heap region. This is a classic length-confusion flaw where the declared stsz entry does not match actual packet data, and the parser trusts the Opus header field values rather than the buffer's true capacity. The ASAN-confirmed READ of size 1 at av_parsers.c:11297 indicates a single-byte sequential over-read consistent with iterating a loop or indexing into a header field without bounds checking.

RemediationAI

Apply upstream fix commit 61bbfd2e89553373ba3449b8ec05b5f098d732a5 from the GPAC GitHub repository (https://github.com/gpac/gpac). No vendor-tagged release version has been independently confirmed as containing this fix; users building from source should ensure their checkout is at or past this commit. As a compensating control, restrict use of 'MP4Box -dxml' exclusively to trusted, internally sourced MP4 files - untrusted or user-supplied media files should not be processed with this flag until the patch is applied. Organizations using GPAC in automated media processing pipelines should add file-source allowlisting to prevent arbitrary MP4 files from reaching the dump/inspect code path. Note that disabling Opus track processing entirely is not straightforward via command-line flags, so the safest mitigation remains patching or input restriction.