CVE-2025-55641

Executive Summary

CVE-2025-55641 is a NULL pointer dereference vulnerability in the gf_isom_copy_sample_info function within the isomedia/isom_write.c file of GPAC MP4Box v2.4. This flaw allows an attacker to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability is triggered when the application attempts to copy sample information from a malformed MP4 file, leading to a crash due to dereferencing a NULL pointer. The CVSS score is 0.0, indicating a lack of official scoring, but the impact is limited to availability (DoS) with low attack complexity and no privileges required, though user interaction is needed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must provide a crafted file to the user.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – The user must open the malicious file.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – The application crashes, causing a DoS.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction and only results in a denial of service.

Deep Dive & Mechanics

The vulnerability resides in the gf_isom_copy_sample_info function in isomedia/isom_write.c. This function is responsible for copying sample information from one MP4 file to another. When processing a crafted MP4 file, the function may encounter a NULL pointer in the sample information structure. The code does not properly validate the pointer before dereferencing it, leading to a segmentation fault and application crash.

The root cause is a lack of input validation on the sample information data. An attacker can craft an MP4 file with malformed sample entries that cause the function to attempt to access a NULL pointer. This is a classic CWE-476 (NULL Pointer Dereference) vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (v2.4):

// In gf_isom_copy_sample_info function
GF_Err gf_isom_copy_sample_info(GF_ISOFile *dest, GF_ISOFile *src, u32 track, u32 sample)
{
    GF_SampleInfo *sInfo = gf_isom_get_sample_info(src, track, sample);
    // No NULL check on sInfo
    GF_Err e = gf_isom_set_sample_info(dest, track, sample, sInfo);
    // ...
}

Patched Code (Hypothetical):

// In gf_isom_copy_sample_info function
GF_Err gf_isom_copy_sample_info(GF_ISOFile *dest, GF_ISOFile *src, u32 track, u32 sample)
{
    GF_SampleInfo *sInfo = gf_isom_get_sample_info(src, track, sample);
    if (!sInfo) {
        return GF_BAD_PARAM; // Return error if NULL
    }
    GF_Err e = gf_isom_set_sample_info(dest, track, sample, sInfo);
    // ...
}

The patch adds a NULL check before dereferencing sInfo, preventing the crash.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker must craft a malicious MP4 file that triggers the NULL pointer dereference. This can be done by manipulating the sample information in the MP4 file's metadata.

Lab Setup:

1. Install GPAC MP4Box v2.4 on a test system.
2. Create a crafted MP4 file using a hex editor or a custom script.
3. Run the following command to trigger the vulnerability:

   mp4box -info crafted.mp4
   

4. Observe the crash.

Crafting the MP4 File:

• Use a tool like mp4box to create a valid MP4 file.
• Modify the stbl box (Sample Table) to contain a stsz box with a sample size of 0 and a stco box with a chunk offset pointing to an invalid location.
• This can cause gf_isom_get_sample_info to return a NULL pointer.

Blue Team

Detection:

• Monitor for crashes of mp4box or GPAC applications.
• Use file integrity monitoring to detect malicious MP4 files.
• Implement network monitoring for unusual MP4 file transfers.

Prevention:

• Update GPAC to a patched version when available.
• Use application whitelisting to prevent execution of untrusted MP4 files.
• Employ sandboxing for processing untrusted media files.

Indicators of Compromise (IOCs)

• File Hashes: (Example hashes for a crafted MP4 file)
  • MD5: d41d8cd98f00b204e9800998ecf8427e
  • SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
• Process Name: mp4box or MP4Box
• Event Logs: Application crash logs with exception code 0xc0000005 (Access Violation) in gf_isom_copy_sample_info.
• Network Indicators: Unusual MP4 file downloads from untrusted sources.

Detection Engineering

YARA Rule

rule CVE_2025_55641_MP4Box_NULL_Pointer {
    meta:
        description = "Detects crafted MP4 files exploiting CVE-2025-55641"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55641"
    strings:
        $stbl = "stbl" ascii wide nocase
        $stsz = "stsz" ascii wide nocase
        $stco = "stco" ascii wide nocase
        $null_size = { 00 00 00 00 } // Sample size of 0
    condition:
        $stbl and $stsz and $stco and $null_size
}

Sigma Rule

title: CVE-2025-55641 MP4Box Crash Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes of MP4Box due to NULL pointer dereference
author: Valters IT
date: 2025-01-01
logsource:
    category: application
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: "Application Error"
        Application_Name: "mp4box.exe"
        Exception_Code: "0xc0000005"
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-55641 MP4Box Malicious MP4 File Transfer"; flow:to_server,established; content:"|00 00 00 00|"; distance:0; within:4; content:"stbl"; distance:0; within:4; content:"stsz"; distance:0; within:4; content:"stco"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch from GPAC when available. The fix involves adding a NULL check in gf_isom_copy_sample_info.
2. Workaround: Avoid processing untrusted MP4 files with GPAC MP4Box v2.4.
3. Mitigation: Use input validation and sanitization for all media files. Implement application-level crash handling to prevent DoS.
4. Monitoring: Deploy the detection rules above to identify exploitation attempts.

Valters IT
Securing Digital Frontiers