What is the CVSS score of CVE-2025-55657?

CVE-2025-55657 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GPAC MP4Box are affected by CVE-2025-55657?

GPAC MP4Box v2.4 contains a denial of service vulnerability allowing attackers to crash the application by submitting a malicious MP4 file, affecting any organization that processes video files from…

How to fix or mitigate CVE-2025-55657?

Within 24 hours: Identify all systems running GPAC MP4Box v2.4; restrict MP4 file submission to trusted sources only and implement file validation before processing. Within 7 days: Deploy application sandboxing or containerization to isolate MP4Box crashes from production infrastructure; evaluate alternative video codecs or processing libraries. Within 30 days: Subscribe to GPAC security advisories and establish a patching plan; migrate to a patched version once available or transition to alternative tools if vendor timeline is unclear.

GPAC MP4Box CVE-2025-55657

HIGH

NULL Pointer Dereference (CWE-476)

2026-06-09 mitre

Denial Of Service Null Pointer Dereference N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:25 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

AnalysisAI

Denial of service in GPAC MP4Box v2.4 allows remote attackers to crash the application by supplying a malicious MP4 file that triggers a NULL pointer dereference in the VVC (Versatile Video Coding) configuration writer. The flaw resides in gf_odf_vvc_cfg_write_bs within odf/descriptors.c and requires no authentication or user privileges beyond convincing the target to process the crafted file. No public exploit identified at time of analysis, and SSVC indicates exploitation has not been observed despite the issue being automatable.

Technical ContextAI

GPAC is an open-source multimedia framework whose MP4Box utility is widely used for packaging, multiplexing, and inspecting ISO Base Media File Format (MP4) content, including modern codecs such as VVC/H.266. The vulnerable routine gf_odf_vvc_cfg_write_bs serializes a VVC decoder configuration record into a bitstream and, per CWE-476 (NULL Pointer Dereference), fails to validate that a pointer derived from the parsed input is non-NULL before dereferencing it. Malformed VVC configuration structures embedded in an MP4 container therefore cause the process to crash. CPE data is not populated in NVD (cpe:2.3:a:n/a:n/a:*), so affected scope must be derived from the description, which explicitly cites GPAC MP4Box v2.4.

RemediationAI

No vendor-released patch identified at time of analysis; the only public reference is an infosec.exchange post (https://infosec.exchange/@sigdevel/116710754169365223) with no linked commit or fixed release. Monitor the GPAC GitHub repository (gpac/gpac) for a patched release beyond 2.4 and upgrade once available. As compensating controls, avoid processing untrusted MP4 files with MP4Box on production or shared systems; if MP4Box is invoked from an automated pipeline or web-facing transcoder, sandbox the process (seccomp, containers, or a dedicated low-privilege user) and enforce automatic restarts so a crash does not halt the pipeline, accepting the trade-off of slightly higher operational complexity. Pre-validate input files with a stricter parser or reject files containing VVC tracks if VVC support is not required, noting this will block legitimate VVC content.