CVE-2025-55641

Vulnerability

A NULL pointer dereference vulnerability exists in the gf_isom_copy_sample_info function within isomedia/isom_write.c of GPAC MP4Box v2.4. The bug is triggered when MP4Box processes a crafted MP4 file containing corrupted Sample Auxiliary Information (SAI) metadata, such as an invalid sai_samples count. The insufficient pointer validation after a failure in SAI merge handling leads to a null read, resulting in a crash. Affected versions are GPAC/MP4Box prior to the fix commit f87b30611380e4dcd03cd4dd9ac553c0ec336826 [1].

Exploitation

An attacker can exploit this vulnerability by crafting an MP4 file with malicious SAI metadata (e.g., an invalid sai_samples count). The attacker does not require authentication or prior access; the only user interaction needed is for the victim to open or process the crafted file with GPAC MP4Box [1]. The vulnerability is triggered during the import operation, specifically when gf_isom_copy_sample_info attempts to read from a pointer that was not validated after a failed SAI merge.

Impact

Successful exploitation causes a denial of service (DoS) due to a segmentation fault (SEGV) as reported by AddressSanitizer, corresponding to a read memory access at address 0x0 [1]. The impact is limited to availability; there is no disclosed information disclosure, data modification, or privilege escalation. The CVSS v3.1 base score is 4.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L [1].

Mitigation

The vulnerability is fixed in GPAC commit f87b30611380e4dcd03cd4dd9ac553c0ec336826 [1]. Users should update GPAC to a version that includes this patch or later. No workarounds are provided in the available references; the recommended action is to avoid processing untrusted MP4 files with affected versions until the update is applied.