GPAC MP4Box CVE-2025-55663

GPAC is an open-source multimedia framework; MP4Box is its primary command-line tool for MP4 container manipulation, import, and export. In the ISO Base Media File Format (ISOBMFF), AV1 video is encapsulated using the 'av01' sample entry box. The 'svcC' box is a Scalable Video Coding configuration structure not expected inside an av01 context. When GPAC's parser encounters this unrecognized combination, the unsupported-box handling path does not initialize or validate the sample entry pointer before control passes to Track_SetStreamDescriptor() in isomedia/track.c. That function later dereferences the invalid pointer at line 1677 during a call chain originating in gf_isom_change_mpeg4_description() → gf_media_update_bitrate_ex() while the track import is still in progress. CWE-476 (NULL Pointer Dereference) accurately classifies the root cause: a missing null/validity check on a pointer that an earlier error path failed to populate. AddressSanitizer confirms the crash as a READ access at address 0x001e3fff8005, consistent with an uninitialized or zeroed pointer being used as a base for a field offset read.