{"id":"CVE-2025-55667","kind":"vulnerability","aliases":["CVE-2025-55667"],"related":[],"title":"GPAC MP4Box: crafted MP4 file crashes the tool with a segfault","description":"A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"A crafted MP4 file makes the dump_isom_saps routine in GPAC's MP4Box tool hit a segmentation violation and crash. An attacker can use it to cause a denial of service against anything that runs MP4Box on untrusted files.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["mp4box-not-used","no-untrusted-mp4-input"],"how_to_check":"- Run `MP4Box -version` and compare against the build in the advisory: `v2.5-DEV-rev1672-gc9a31d0e1-master` is the affected development revision.\n- Check whether any pipeline runs `MP4Box -info` or dump options on uploaded media.","fix":"- unknown: the sources do not name a fixed revision; rebuild GPAC from a newer upstream commit or move to a stable release once one includes the fix.","status":"open","published_at":"2026-10-19T18:16:58+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:12:46+00:00","updated_at":"2026-10-25T04:12:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:12:46Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed revision; rebuild GPAC from a newer upstream commit or move to a stable release once one includes the fix.","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file crashes the tool with a segfault","impact":"low","summary":"A crafted MP4 file makes the dump_isom_saps routine in GPAC's MP4Box tool hit a segmentation violation and crash. An attacker can use it to cause a denial of service against anything that runs MP4Box on untrusted files.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"MP4Box process crashes on a crafted file, causing denial of service","analyst_note":"Check the NVD entry and the GPAC upstream repository for the fixed commit or release and whether stable releases are affected.","how_to_check":"- Run `MP4Box -version` and compare against the build in the advisory: `v2.5-DEV-rev1672-gc9a31d0e1-master` is the affected development revision.\n- Check whether any pipeline runs `MP4Box -info` or dump options on uploaded media.","needs_analyst":true,"not_affected_if":["no-untrusted-mp4-input","mp4box-not-used"],"who_is_affected":"Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media ingest or conversion services that inspect uploads. Systems that only process their own trusted files, or do not use MP4Box at all, can skip it. The sources do not say whether released versions are affected beyond the listed development build.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3323,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':13A,16A '-55667':14A,17A '/mp4box/filedump.c':76C 'anyth':60B 'attack':49B,81C 'caus':54B,83C 'craft':3A,28B,92C 'crash':6A,47B 'cve':12A,15A 'denial':56B,85C 'dos':88C 'dump':33B,72C 'file':5A,30B,66B,94C 'function':75C 'gpac':1A,18B,38B,78C 'hit':42B 'host':26B 'isom':34B,73C 'make':31B 'media':20B 'media-process':19B 'mp4':4A,29B,93C 'mp4box':2A,22B,40B,63B,79C 'packag':23B 'process':21B 'routin':36B 'run':62B 'sap':35B,74C 'segfault':11A 'segment':44B,68C 'self':25B 'self-host':24B 'servic':58B,87C 'suppli':90C 'tool':8A,41B 'untrust':65B 'use':51B 'v2.5-dev-rev1672-gc9a31d0e1-masterallows':80C 'via':89C 'violat':45B,69C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media ingest or conversion services that inspect uploads. Systems that only process their own trusted files, or do not use MP4Box at all, can skip it. The sources do not say whether released versions are affected beyond the listed development build.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-55667","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55667","severity":null,"published_at":"2026-10-19T18:16:58+00:00","modified_at":"2026-10-20T19:17:10+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}