Key points
- CVE-2025-55654 affects GPAC/MP4Box version 2.4 specifically.
- The flaw is a use-after-free error in the gf_filter_pid_get_packet function.
- Alexander A. Shvedov reported the issue on October 20.
Alexander A. Shvedov reported a use-after-free vulnerability in GPAC/MP4Box 2.4 on October 20. The flaw resides in the gf_filter_pid_get_packet function and can be triggered when processing crafted NHML export inputs. This issue was disclosed via the oss-security mailing list.
The vulnerability is classified as medium severity with a CVSS 3.1 score of 5.5. According to the Base Degree of Urgency assessment, the vector requires local access, low complexity, and low privileges. No user interaction is needed for exploitation. The impact is limited to high availability loss, with no compromise of confidentiality or integrity.
Technical context
The defect is identified as CVE-2025-55654 and maps to CWE-416, which covers use-after-free errors. The researcher reproduced the issue at specific commits in the project repository. The vulnerability allows an attacker to access memory that has already been freed, leading to unpredictable behavior or application termination.
This type of memory corruption occurs when a program continues to use a pointer after the memory it references has been released. In this case, the specific trigger involves the NHML export feature within the MP4Box utility.
Who is affected
Only GPAC/MP4Box version 2.4 is confirmed to be affected by this vulnerability. The advisory notes that the issue was reproduced at commits 63eccc33d4a2b731ebb31581ff5673a2c0b13ad4 and 0ab2af43da6b89a556ce52086057d1812ceade9e. Systems running this specific version are exposed to the risk.
Other versions of the software are not mentioned in the advisory. Administrators should verify their installed version against the affected list. The fix was implemented in commit 0ccd2927c7145f5ab0352c5b15f787757b34eb18.
Next steps
Administrators should audit their environments for GPAC/MP4Box version 2.4. If this version is present, they should apply the patch corresponding to commit 0ccd2927c7145f5ab0352c5b15f787757b34eb18. Organizations should monitor for any unofficial patches or backports provided by their distribution vendors.
Signals worth monitoring
Teams usually observe unexpected application crashes or segmentation faults when use-after-free errors are triggered. Check system logs for sudden termination of the MP4Box process without prior warning. Monitor for unusual memory access patterns or heap corruption indicators in debug logs. Look for repeated failed executions of NHML export tasks. Isolate affected instances immediately to prevent further exploitation attempts. Review access controls to ensure only authorized users can trigger these functions.
What to do and how to stay safe
- Verify if GPAC/MP4Box version 2.4 is installed on your systems.
- Apply the official patch once the vendor provides an update.
- Monitor application logs for unexpected crashes or memory errors.
- Restrict access to MP4Box tools to
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
