CVE-2025-55640 in MP4Box
Summary
by MITRE • 10/16/2026
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified as CVE-2023-5176 represents a critical memory safety issue within the GPAC multimedia framework, specifically affecting the MP4Box utility in version 2.4. This flaw is located in the stbl_AddSize function found within the source file isomedia/stbl_write.c. The core technical nature of this defect is a heap buffer overflow, which occurs when the application writes data beyond the allocated boundaries of a memory block on the heap. In the context of MP4 processing, this typically happens during the parsing and writing of media sample tables (stbl), where size calculations or array indexing operations fail to properly validate input lengths against pre-allocated buffers. An attacker can exploit this by constructing a maliciously crafted MP4 file that triggers these erroneous memory writes when processed by GPAC MP4Box.
From an operational perspective, the immediate impact of exploiting this heap buffer overflow is a Denial of Service condition. When the out-of-bounds write corrupts adjacent heap metadata or application data structures, it leads to program instability and eventual crash. While modern operating systems employ memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEPX), these do not prevent crashes caused by corruption of internal state variables that lead to segmentation faults or abort signals. For users who rely on GPAC MP4Box for automated media processing, conversion pipelines, or forensic analysis, the ability of an attacker to cause a crash via a single file input disrupts service availability and can interrupt critical workflows.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-122, which describes heap-based buffer overflows resulting from insufficient bounds checking on data written to dynamically allocated memory. Furthermore, the exploitation vector falls under MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter if the crash is part of a larger attack chain, or more accurately T1496 Resource Hijacking for Denial of Service scenarios where system resources are consumed through repeated crashes. The lack of proper validation on input data provided by external sources highlights a failure in secure coding practices regarding memory management during file parsing operations.
To mitigate the risks associated with this vulnerability, organizations should immediately update GPAC MP4Box to version 2.5 or later, where the stbl_AddSize function has been patched to include rigorous bounds checking and input validation before performing heap allocations and writes. In environments where immediate patching is not feasible, it is advisable to restrict access to the tool by filtering incoming media files through a sandboxed environment or using an intermediary service that validates file integrity and structure before processing. Additionally, enabling core dump analysis can help in detecting such crashes during security audits, allowing for proactive identification of malformed inputs attempting to trigger this overflow condition.