As cited
Copy frozen at (site build).
vulnerabilities
CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata
A heap buffer overflow vulnerability exists in GPAC/MP4Box when processing crafted MP4 files with corrupted sample metadata, affecting versions prior to commit 321624f. The flaw occurs in the stbl_AddSize function and carries a CVSS 3.1 score of 8.8 (HIGH), requiring only user interaction and a network vector to trigger remote code execution.
Why it matters: Developers and users of GPAC/MP4Box or systems that embed this library should update immediately, as an attacker can deliver a malicious MP4 file that crashes the application or executes arbitrary code without privileges or special access.
- Source published
- First seen by Cybersecurity Tracker