Live › vulnerability › CVE-2025-55667
Go to dashboardA crafted MP4 file makes the dump_isom_saps routine in GPAC's MP4Box tool hit a segmentation violation and crash. An attacker can use it to cause a denial of service against anything that runs MP4Box on untrusted files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media ingest or conversion services that inspect uploads. Systems that only process their own trusted files, or do not use MP4Box at all, can skip it. The sources do not say whether released versions are affected beyond the listed development build.
No product ranges from the sources yet.
MP4Box -version and compare against the build in the advisory: v2.5-DEV-rev1672-gc9a31d0e1-master is the affected development revision.MP4Box -info or dump options on uploaded media.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-55667")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.