GPAC MP4Box CVE-2025-55662

The vulnerability is triggered when MP4Box processes a crafted MP4 file containing an Opus audio track with a malformed packet header where nb_frames is zero or otherwise invalid. The crash specifically occurs along the Opus dump/inspection code path, reachable via the -dxml flag (and similar inspection modes) as confirmed by the AddressSanitizer stack trace. No authentication or special system privileges are required; however, active user interaction is required - a user or an automated process must explicitly invoke MP4Box on the malicious file (e.g., MP4Box -add crafted.mp4 -dxml -out /dev/null). Exploitation is strictly limited to a process crash (availability impact only); no confidentiality or integrity impact has been demonstrated. Systems that do not process Opus-containing MP4 files through GPAC MP4Box's dump/inspection path are not exposed.

The reporter-supplied CVSS 3.1 score of 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) is well-calibrated for this vulnerability class. Real-world risk is moderate: the public PoC file lowers the exploitation bar significantly for any operator who processes untrusted MP4 files, but impact is strictly bounded to an application crash - no confidentiality or integrity impact is present, and no code execution path has been identified. The UI:R metric correctly captures that a user or automated pipeline must invoke MP4Box on the malicious file; passive network exposure alone does not trigger the vulnerability. No EPSS score was provided in the input, so exploitation probability cannot be quantified precisely, but the low-complexity, zero-privilege delivery model combined with an available PoC suggests meaningful risk for file-processing pipelines. This vulnerability is not in CISA KEV, consistent with its limited impact severity. The highest practical risk scenario is an automated MP4 ingestion pipeline running MP4Box on untrusted user-supplied content without process isolation, where repeated crashes could constitute a sustained DoS.

An attacker crafts a malicious MP4 file containing an Opus audio track where the packet header's nb_frames field is set to zero. The file is uploaded to a media platform or sent to a target that automatically processes MP4 files using GPAC MP4Box - for example, a transcoding pipeline that runs MP4Box with -dxml to inspect metadata. When MP4Box processes the file, gf_opus_parse_packet_header() triggers a divide-by-zero, crashing the MP4Box process and disrupting the pipeline. A public PoC file demonstrating this exact crash is available at https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/2/2_poc.mp4.