CVE-2025-55639

MEDIUM EPSS 24.3%
Published Jun 23, 20266d ago · Modified Jun 23, 20266d ago
6.5 CVSS 3.1
Medium
Find Similar
Published Jun 23, 2026 6d ago
Last Modified Jun 23, 2026 6d ago

Description

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
24.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-476 NULL Pointer Dereference Memory Safety

References 4

  • github.com https://github.com/gpac/gpac/commit/027ce139dda498ee95df36db9f9f6f3cadce8ec9
  • github.com https://github.com/gpac/gpac/issues/3260
  • github.com https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/23/23_poc.mp4
  • infosec.exchange https://infosec.exchange/@sigdevel/116769184815236865

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.