What is the CVSS score of CVE-2025-55652?

CVE-2025-55652 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

GPAC MP4Box CVE-2025-55652

EUVD-2025-210150 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-06-15 mitre

GHSA-7hvc-93r4-rgmh

Buffer Overflow Denial Of Service Heap Overflow N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local vector because MP4Box is a CLI tool triggered by file open; no privileges needed but active user interaction required; crash-only impact means A:H with C:N and I:N.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:18 vuln.today

CVSS changed

Jun 15, 2026 - 21:22 NVD

5.5 (None) 5.5 (MEDIUM)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

AnalysisAI

Heap buffer overflow in GPAC MP4Box v2.4 crashes the application when parsing a maliciously crafted MP4 file containing an invalid VP codec configuration. The vulnerable function, gf_isom_vp_config_new in isomedia/avc_ext.c, fails to safely handle attacker-controlled input during ISO Base Media File Format parsing, resulting in a Denial of Service condition. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, placing this in a low-urgency remediation tier per SSVC signals.

Technical ContextAI

GPAC is an open-source multimedia framework; MP4Box is its command-line tool for creating, inspecting, and manipulating ISO Base Media File Format (ISOBMFF / MP4) files. The affected code path, gf_isom_vp_config_new in isomedia/avc_ext.c, handles construction of VP codec configuration boxes (used for VP8/VP9 video tracks in MP4 containers). CWE-122 (Heap-based Buffer Overflow) indicates that the function writes beyond the bounds of a heap-allocated buffer when processing a crafted VP config structure, corrupting adjacent heap memory. The CPE data supplied is listed as n/a, so the exact affected version is drawn solely from the CVE description identifying GPAC MP4Box v2.4. The CVSS local attack vector (AV:L) confirms that the overflow is triggered at file-parse time on the processing host, not via a network-facing service.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis. The disclosure references an oss-security mailing list post (http://www.openwall.com/lists/oss-security/2026/06/13/4) and a Mastodon disclosure (https://infosec.exchange/@sigdevel/116736829161374790), but neither reference a specific fixed release from the GPAC project. Users should monitor the official GPAC GitHub repository for a patched release addressing the gf_isom_vp_config_new function. As a compensating control, avoid processing untrusted or externally sourced MP4 files with MP4Box v2.4 until a patch is available; this directly eliminates the user-interaction trigger condition. If MP4Box is used in automated pipelines, restrict its input sources to internally validated files and run the process in a sandboxed or containerized environment to contain any crash or potential escalation. Disabling VP codec track parsing, if the tool exposes such an option, would also mitigate the specific code path, though this would reduce functionality for VP8/VP9 content.