What is the CVSS score of EUVD-2025-210149?

EUVD-2025-210149 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

GPAC MP4Box EUVD-2025-210149

| CVE-2025-55650 MEDIUM

Use After Free (CWE-416)

2026-06-13

GHSA-732p-5ccf-395m

Denial Of Service Memory Corruption Use After Free Gpac

5.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

4.3 MEDIUM

File deliverable over network (AV:N), no privileges needed (PR:N), but user must run MP4Box -svg (UI:R); only availability impact (crash, A:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 13, 2026 - 22:19 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Heap use-after-free in GPAC MP4Box's MPEG-4 LASeR/SVG processing path crashes the tool when parsing a crafted MP4 file with the -svg conversion flag. The flaw occurs in gf_svg_node_del() at svg_types.c:107, where an SVG node is freed and then read again during scene graph teardown via gf_sg_reset()/gf_node_unregister(), confirmed by AddressSanitizer. Impact is limited to availability (process crash/DoS); no confidentiality or integrity impact is demonstrated. A public proof-of-concept MP4 file exists on GitHub; no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

GPAC is an open-source multimedia framework and its MP4Box tool handles MP4 container manipulation, including conversion to SVG/LASeR scenes. The -svg flag triggers the MPEG-4 LASeR scene export path, which allocates SVG nodes via gf_svg_create_node(). CWE-416 (Use After Free) manifests when gf_svg_node_del() (svg_types.c:126) frees a heap-allocated 24-byte SVG node structure, but the teardown sequence then calls gf_node_unregister() and gf_sg_reset() (base_scenegraph.c:759 and 481 respectively), which perform a READ of size 8 at the already-freed address. ASan confirms the freed allocation and the subsequent dangling-pointer dereference in gf_svg_node_del() at line 107. The root cause is a lifetime management error in the scene graph cleanup ordering - the node is unregistered before all references to it are cleared. Affected code is in the gpac/gpac repository, all versions prior to commit 46be5f928660530d5332cd2f1d177208737558ef.

RemediationAI

An upstream fix is available via commit 46be5f928660530d5332cd2f1d177208737558ef in the gpac/gpac GitHub repository; however, no tagged release version incorporating this fix has been independently confirmed, so users should build from source at or after this commit or monitor the GPAC release page for a patched distribution package. As a compensating control, avoid invoking MP4Box with the -svg flag on any MP4 files from untrusted or externally sourced inputs until a patched release is confirmed. In automated pipelines, enforce strict input validation and sandbox MP4Box execution (e.g., via seccomp or a container with limited permissions) so that a triggered crash does not propagate to dependent services. Restricting write access to the MP4Box binary to trusted operators limits exposure in multi-user environments. References: GitHub issue https://github.com/gpac/gpac/issues/3162 and oss-security advisory https://seclists.org/oss-sec/2026/q2/912.