Product: GPAC (MP4Box)
Affected: gpac/gpac prior to fix commit
(e95f3064d846e4606276fff111e0f97df1576a04)
CVE: CVE-2025-55647
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
When MP4Box processes a crafted MP4 file containing malformed
Protection System Specific Header (PSSH) metadata, mp4_mux_cenc_insert_pssh()
in filters/mux_isom.c does not sufficiently validate PSSH-related size
fields such as kid_count/dataSize before using them in a buffer size
calculation.
An attacker-controlled value overflows the size computation, causing
realloc() to be called with an enormous size. AddressSanitizer reports
an out-of-memory condition at filters/mux_isom.c:4326, where realloc()
attempts to allocate 0xe40000100 bytes, reached via mp4_mux_start_fragment()
while MP4Box runs DASH segmentation on the crafted file.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: CC="gcc -fsanitize=address -g" CXX="g++ -fsanitize=address -g" ;
-Command: ./MP4Box -dash 10000 ./15_poc.mp4
Asan-log:
==3757041==ERROR: AddressSanitizer: out of memory: allocator is trying to
allocate 0xe40000100 bytes
#0 0x7f635aaf3b78 in realloc
../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:85
#1 0x55f879e99c00 in mp4_mux_cenc_insert_pssh filters/mux_isom.c:4326
#2 0x55f879ed3601 in mp4_mux_start_fragment filters/mux_isom.c:6396
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/15/15_poc.mp4
References:
https://github.com/gpac/gpac/issues/3235
https://www.cve.org/CVERecord?id=CVE-2025-55647
https://infosec.exchange/@sigdevel/116736795058798433
——
Best regards, Alexander A. Shvedov
https://github.com/sigdevel
