CVE-2025-55654
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Risk Assessment
A crafted file can crash the application or potentially lead to further consequences from use-after-free, reducing service availability.
Recommendation
Update GPAC MP4Box to a patched version and avoid processing untrusted media files until the update is applied.
Other vulnerabilities in GPAC MP4Box
See all- CVE-2025-60476Medium
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- CVE-2025-60469Medium
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- CVE-2025-60493Medium
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
- CVE-2025-60492Medium
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a denial of service via a crafted MP4 file.
- CVE-2025-60491Medium
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
- CVE-2025-60490Medium
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- CVE-2025-60487Medium
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
- CVE-2025-60478Medium
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
- CVE-2025-71438Medium
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- CVE-2025-60489Medium
A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Original NVD description (English source)
A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS