GPAC MP4Box CVE-2025-55661

GPAC is an open-source multimedia framework widely used for MP4 file analysis, packaging, and inspection; its MP4Box command-line tool is the primary attack surface here. The vulnerable function gf_opus_parse_packet_header() in media_tools/av_parsers.c is responsible for parsing the Opus codec's Table of Contents (TOC) byte and subsequent header fields in an Opus audio packet embedded within an ISOBMFF/MP4 container. The root cause (CWE-122, Heap-based Buffer Overflow) is insufficient validation of the input buffer length before indexing into header fields when the Opus TOC code is 3 - a value that encodes a variable-length packet count and implies a larger header footprint than a minimal 3-byte heap region. The sample allocated by Media_GetSample() is too small, and the read at offset +3 goes one byte beyond the end of that allocation. The execution path is: MP4Box -dxml → dump_isom_opus (filedump.c:1501) → gf_inspect_dump_opus_internal (filters/inspect.c:1830) → gf_opus_parse_packet_header (av_parsers.c:11326). The issue is confirmed reproducible with AddressSanitizer on the master branch at the time of discovery.