What is the CVSS score of CVE-2025-55658?

CVE-2025-55658 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GPAC MP4Box are affected by CVE-2025-55658?

GPAC MP4Box v2.4 contains a high-severity denial-of-service vulnerability triggered by crafted MP4 files, risking disruption to media processing operations for dependent organizations.

How to fix or mitigate CVE-2025-55658?

Within 24 hours: Identify all production systems running GPAC MP4Box v2.4 and document the criticality of media processing workflows. Within 7 days: Implement protective controls-deploy MP4Box in isolated processes (containerization/sandboxing), restrict input to trusted media sources, and disable the tool if not operationally essential. Within 30 days: Monitor GPAC project for patch release; initiate vendor communication if timeline is unclear; evaluate and plan transition to alternative media processing solutions.

GPAC MP4Box CVE-2025-55658

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-09 mitre

Denial Of Service N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jun 09, 2026 - 22:22 NVD

HIGH MEDIUM

CVSS changed

Jun 09, 2026 - 22:22 NVD

7.5 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 21:24 vuln.today

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

AnalysisAI

Denial-of-service in GPAC MP4Box v2.4 allows remote attackers to crash the multimedia tool via a crafted MP4 file that triggers a floating-point exception in the gf_opus_parse_packet_header function. No public exploit identified at time of analysis, and CISA has not listed this in KEV; SSVC scoring indicates exploitation has not been observed but the flaw is automatable with partial technical impact. CVSS 7.5 reflects high availability impact achievable without authentication or user interaction once a malicious file is processed.

Technical ContextAI

GPAC is an open-source multimedia framework, and MP4Box is its command-line tool for packaging, demuxing, and analyzing ISO Base Media File Format (MP4) containers. The defect is in media_tools/av_parsers.c within gf_opus_parse_packet_header, the routine that parses Opus audio packet headers embedded in MP4 streams. The CWE-400 (Uncontrolled Resource Consumption) classification reflects how a divide-by-zero or similar floating-point exception during malformed Opus header parsing terminates the process. The single CPE entry (cpe:2.3:a:n/a:n/a:*) is a placeholder rather than a normalized GPAC product CPE, so downstream vulnerability scanners may not match this advisory cleanly to installed GPAC packages.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - the only reference is a social-media post at https://infosec.exchange/@sigdevel/116710224797830572 rather than a tagged GPAC release. Monitor the GPAC GitHub repository (gpac/gpac) for a fix to gf_opus_parse_packet_header in media_tools/av_parsers.c and upgrade past v2.4 once available. As compensating controls, restrict MP4Box to processing trusted media only by isolating it in a sandbox or container with restart-on-crash semantics (systemd Restart=on-failure or a worker-pool with circuit breakers), reject Opus-bearing MP4s at the ingestion layer if Opus audio is not required by your pipeline (trade-off: legitimate Opus content is also dropped), and run MP4Box under a resource-limited unprivileged user so a crash does not cascade. For web-facing upload handlers, validate MP4 structure with a separate sanitizer before invoking GPAC.