What is the CVSS score of CVE-2025-55659?

CVE-2025-55659 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

GPAC MP4Box CVE-2025-55659

MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-09 mitre

Denial Of Service Null Pointer Dereference N A

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:24 vuln.today

Severity Changed

Jun 09, 2026 - 21:22 NVD

HIGH MEDIUM

CVSS changed

Jun 09, 2026 - 21:22 NVD

7.5 (HIGH) 6.5 (MEDIUM)

CVSS changed

Jun 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

AnalysisAI

NULL pointer dereference in GPAC MP4Box v2.4 allows unauthenticated remote attackers to crash the application by delivering a crafted MP4 file that a user opens. The vulnerable function ctts_box_write in isomedia/box_code_base.c fails to validate a pointer before dereferencing it when processing a malformed Composition Time to Sample (ctts) box, resulting in a denial-of-service condition. No public exploit code or active exploitation has been identified; SSVC rates exploitation status as none, though delivery is rated automatable.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for MP4/ISOBMFF container parsing, writing, and analysis. MP4Box is its command-line tool for manipulating ISO Base Media File Format files. The ctts_box_write function in isomedia/box_code_base.c is responsible for serializing the Composition Time to Sample box - an optional box in the MP4 container spec that stores per-sample timestamp offsets. CWE-476 (NULL Pointer Dereference) indicates that the function dereferences a pointer that has not been verified as non-NULL, most likely when the ctts box structure references sample table data that is absent or malformed in a crafted input file. The CPE entry in the NVD submission is a placeholder (cpe:2.3:a:n/a:n/a) and provides no additional version enumeration beyond what the description explicitly states (v2.4).

RemediationAI

No vendor-released patch has been identified at time of analysis - no patched version number appears in the available reference data, and no official GPAC security advisory was cited. The only reference is a social media post (https://infosec.exchange/@sigdevel/116710743410087676), which should be consulted for initial disclosure context. As a compensating control, organizations should avoid invoking MP4Box v2.4 on untrusted or externally-sourced MP4 files until a fix is confirmed. For automated pipelines that process user-supplied media, consider sandboxing MP4Box invocations (e.g., via seccomp, containers, or restricted user accounts) so that a crash does not affect upstream service availability. Monitoring the official GPAC GitHub repository for commits addressing ctts_box_write in isomedia/box_code_base.c is recommended to identify when an upstream fix lands, noting that a commit-level fix does not constitute a released patched version until a tagged release is published.