Description
A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Published: 2026-06-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A NULL pointer dereference occurs in the gf_isom_copy_sample_info function of GPAC MP4Box v2.4. The flaw is triggered by a crafted MP4 file that causes the application to crash or become unresponsive, resulting in a denial of service that can disrupt media processing or playback. The weakness corresponds to CWE-476, which involves dereferencing a null pointer without prior validation.

Affected Systems

The vulnerability affects GPAC MP4Box 2.4. No other versions or alternate build targets are listed, so all installations running this exact version are potentially impacted.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% shows a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by a crafted MP4 file that forces the application to crash, leading to a denial of service. Based on the description, it is inferred that the attack could be remote if the application processes MP4 files from external sources.

Generated by OpenCVE AI on June 18, 2026 at 01:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any available vendor update or patch that addresses the null pointer dereference.
  • Configure the MP4Box utility to process only files from trusted sources or run the processing in a restricted, sandboxed environment.
  • Validate MP4 files in a sandboxed environment before processing to detect and reject malformed content.

Generated by OpenCVE AI on June 18, 2026 at 01:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 18 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title NULL Pointer Dereference in GPAC MP4Box Leading to Denial of Service

Tue, 16 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Title NULL Pointer Dereference in GPAC MP4Box Leading to Denial of Service

Tue, 16 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Gpac gpac
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac gpac

Tue, 16 Jun 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac mp4box
Vendors & Products Gpac
Gpac mp4box

Mon, 15 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Mon, 15 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 19:30:00 +0000

Type Values Removed Values Added
Description A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
References

Subscriptions

Gpac Gpac Mp4box
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-15T20:15:43.564Z

Reserved: 2025-08-13T00:00:00.000Z

Link: CVE-2025-55641

cve-icon Vulnrichment

Updated: 2026-06-15T19:21:47.887Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-15T20:16:22.687

Modified: 2026-06-16T17:28:32.243

Link: CVE-2025-55641

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-18T02:00:05Z

Weaknesses