Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit
(74fecde32cd477ab097f3e6db55a32b259f3313d)
CVE: CVE-2025-55652
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
When MP4Box runs a DASH segmentation on a crafted MP4 file containing
malformed VP codec configuration data in the stsd box (including an
unknown D0ncv box type), gf_isom_vp_config_new() in isomedia/avc_ext.c
does not sufficiently validate buffer boundaries when allocating the
VP codec configuration box.
The function allocates an undersized 88-byte box structure and then
writes VP/NALU configuration data beyond it. AddressSanitizer reports
a heap-buffer-overflow WRITE of size 8 at isomedia/avc_ext.c:1962, 136
bytes after the 88-byte heap region, reached via mp4_mux_setup_pid()
while MP4Box sets up the PID for the crafted track during DASH
segmentation.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ;
-Command: ./MP4Box -dash 10000 ./18_poc.mp4
Asan-log:
==4147309==ERROR: AddressSanitizer: heap-buffer-overflow on address
0x508000003180 at pc 0x55cc296f3879 bp 0x7ffda97c9590 sp 0x7ffda97c9588
WRITE of size 8 at 0x508000003180 thread T0
#0 0x55cc296f3878 in gf_isom_vp_config_new isomedia/avc_ext.c:1962
#1 0x55cc2a01734f in mp4_mux_setup_pid filters/mux_isom.c:2895
#2 0x55cc29beb268 in gf_filter_pid_configure filter_core/filter_pid.c:919
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/18/18_poc.mp4
References:
https://github.com/gpac/gpac/issues/3242
https://www.cve.org/CVERecord?id=CVE-2025-55652
https://infosec.exchange/@sigdevel/116736829161374790
——
Best regards, Alexander A. Shvedov
https://github.com/sigdevel
