Description
A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Published: 2026-06-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stack buffer overflow has been identified in the filein_process function of GPAC MP4Box v2.4, which is triggered when parsing a maliciously crafted MP4 file. The overflow corrupts the stack of the MP4Box process and causes it to crash, resulting in a denial of service. No code execution or remote access capabilities are described, so the flaw does not enable arbitrary execution of attacker supplied code.

Affected Systems

The vulnerability resides in GPAC MP4Box version 2.4. No other affected versions or additional product lines are listed. Consequently, any installation of MP4Box v2.4 that processes MP4 content is potentially impacted, while newer releases without this flaw are not mentioned as affected.

Risk and Exploitability

The CVSS score of 7.5 signals a high severity, but the EPSS score is unavailable and the vulnerability is not included in the CISA KEV catalog, implying limited evidence of active exploitation. Attackers would need to supply a crafted MP4 file to the MP4Box tool – a scenario typical in multimedia processing pipelines or manual media manipulation – to trigger the crash and disrupt service availability.

Generated by OpenCVE AI on June 9, 2026 at 22:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GPAC MP4Box to a version that has fixed the buffer‑overflow bug
  • Run MP4Box inside a sandboxed or containerised environment and configure automatic restart on crash
  • Validate MP4 input to reject files with oversized headers or malformed atom structures before invoking MP4Box

Generated by OpenCVE AI on June 9, 2026 at 22:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 14 Jun 2026 00:30:00 +0000

Type Values Removed Values Added
References

Fri, 12 Jun 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Gpac gpac
CPEs cpe:2.3:a:gpac:gpac:2.4:*:*:*:*:*:*:*
Vendors & Products Gpac gpac

Wed, 10 Jun 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Tue, 09 Jun 2026 22:45:00 +0000

Type Values Removed Values Added
Title GPAC MP4Box 2.4 Stack Buffer Overflow Causes DoS

Tue, 09 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-121
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 18:45:00 +0000

Type Values Removed Values Added
Description A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
References

Subscriptions

Gpac Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-15T18:52:39.262Z

Reserved: 2025-06-16T00:00:00.000Z

Link: CVE-2025-52292

cve-icon Vulnrichment

Updated: 2026-06-13T23:25:13.935Z

cve-icon NVD

Status : Modified

Published: 2026-06-09T19:17:31.050

Modified: 2026-06-14T00:16:18.850

Link: CVE-2025-52292

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-10T03:00:10Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow