CVE-2025-55659: NULL Pointer Dereference in GPAC MP4Box with PoC

Vulnerability Overview Vulnerability Name: CVE-2025-55659 - NULL Pointer Dereference in GPAC MP4Box Vulnerability Type: NULL Pointer Dereference Vulnerability Description: When processing specially crafted or truncated MP4 files, the function in fails to adequately validate critical pointers and the state of timestamp derivation. This may trigger a NULL pointer dereference during the writing of the box, leading to a Denial of Service (DoS). Specific Details: - When processing truncated MP4 files, the handling of negative timestamps may leave the box entry pointer in an invalid or NULL state. - The write path subsequently dereferences the NULL pointer, causing a crash. - AddressSanitizer reports a "SEGFAULT" at address , with the crash occurring in . Impact Scope Affected Component: function in Affected Product: MP4Box (open-source multimedia project GPAC) Affected Versions: MP4Box version 2.4 and earlier Attack Conditions: - An attacker provides a specially crafted or truncated MP4 file that triggers invalid negative timestamp handling. - User interaction is required; this occurs when a victim manually processes a malicious MP4 file, or when an automated workflow invokes MP4Box on attacker-controlled media. Impact: - The directly observed impact is Denial of Service due to process termination. - The crash is caused by a NULL pointer dereference on the zero page, with no evidence of arbitrary code execution observed. Remediation Fix Status: The issue has been fixed in a GPAC commit. Fix Commit: Recommended Actions: - Users should update to a GPAC build containing this commit or a later one. - The affected code should validate composition time entries and the state of timestamp derivation before writing the box, and should cleanly reject damaged/truncated MP4 inputs. POC Code References Issue: github.com/gpac/gpac/issues/31 PoC: github.com/sigdevel/pocs/blob/... Fix: github.com/gpac/gpac/commit/24... Credits Author: @sigdevel

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-55659: NULL Pointer Dereference in GPAC MP4Box with PoC