Live › vulnerability › CVE-2025-55654
Go to dashboardGPAC MP4Box v2.4 has a use-after-free in the gf_filter_pid_get_packet function in filter_core/filter_pid.c. An attacker who supplies a crafted file can crash the tool, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC MP4Box v2.4 on untrusted media files, for example in a batch transcoding or upload pipeline. Systems that only process files they create themselves are unlikely to be exposed. unknown for the fixed version.
No product ranges from the sources yet.
MP4Box -version to see whether the installed build is v2.4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
This page as .md · .json · in your agent: get_signal("CVE-2025-55654")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.