{"id":"CVE-2025-55640","kind":"vulnerability","aliases":["CVE-2025-55640"],"related":[],"title":"GPAC MP4Box: crafted MP4 file triggers heap overflow and denial of service","description":"A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"GPAC MP4Box v2.4 has a heap buffer overflow in the stbl_AddSize function in isomedia/stbl_write.c. A crafted MP4 file can crash the tool, causing a denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","other"],"not_affected_if":["no-untrusted-mp4-input"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release (unknown from sources)\n- Check whether MP4Box processes untrusted MP4 files, such as user uploads in a media pipeline","fix":"- Upgrade GPAC MP4Box past `2.4` to a release that includes the fix (exact version unknown from sources)\n- Until patched, do not run MP4Box on untrusted input","status":"open","published_at":"2026-10-16T19:16:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T05:27:43+00:00","updated_at":"2026-10-25T05:27:43+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:27:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC MP4Box past `2.4` to a release that includes the fix (exact version unknown from sources)\n- Until patched, do not run MP4Box on untrusted input","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file triggers heap overflow and denial of service","impact":"low","summary":"GPAC MP4Box v2.4 has a heap buffer overflow in the stbl_AddSize function in isomedia/stbl_write.c. A crafted MP4 file can crash the tool, causing a denial of service.","category":"other","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker crashes MP4Box processing via crafted file, denial of service","analyst_note":"Confirm the fixed version and whether the attack is only a crash or can also lead to code execution, using the GPAC project advisory or the NVD entry.","how_to_check":"- Run `MP4Box -version` and compare against the fixed release (unknown from sources)\n- Check whether MP4Box processes untrusted MP4 files, such as user uploads in a media pipeline","needs_analyst":true,"not_affected_if":["no-untrusted-mp4-input"],"who_is_affected":"Teams that run GPAC MP4Box v2.4 to process MP4 files, especially where files come from users or external sources. Systems that only handle trusted, locally produced media are less exposed. The sources do not say whether other GPAC components are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000617,"input_tokens":3311,"output_tokens":572,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':14A,17A '-55640':15A,18A 'addsiz':35B,59C 'allow':66C 'attack':67C 'buffer':30B,54C 'caus':47B,69C 'craft':3A,40B,78C 'crash':44B 'cve':13A,16A 'denial':10A,49B,71C 'dos':74C 'file':5A,42B,80C 'function':36B,60C 'gpac':1A,19B,24B,63C 'heap':7A,29B,53C 'isomedia/stbl_write.c':38B,61C 'media':21B 'media-process':20B 'mp4':4A,41B,79C 'mp4box':2A,23B,25B,64C 'overflow':8A,31B,55C 'process':22B 'servic':12A,51B,73C 'stbl':34B,58C 'suppli':76C 'tool':46B 'trigger':6A 'v2.4':26B,65C 'via':75C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC MP4Box v2.4 to process MP4 files, especially where files come from users or external sources. Systems that only handle trusted, locally produced media are less exposed. The sources do not say whether other GPAC components are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:16:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-55640","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55640","severity":null,"published_at":"2026-10-16T19:16:56+00:00","modified_at":"2026-10-17T18:16:28+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}