CVE-2025-55645

Executive Summary

CVE-2025-55645 is a heap buffer overflow vulnerability discovered in the gf_cenc_set_pssh function located in isomedia/drm_sample.c of GPAC MP4Box v2.4. The flaw allows an attacker to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability arises from improper bounds checking when processing the Protection System Specific Header (PSSH) box within an MP4 file, leading to a heap-based buffer overflow. This can crash the application or potentially be leveraged for further exploitation. The CVSS score is 0.0 due to incomplete scoring data, but the technical impact is a local DoS requiring user interaction (opening a malicious file). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 0.0 (Temporarily unassigned, but estimated high availability impact)
• Attack Vector: Local (AV:L) – requires the victim to open a crafted MP4 file.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must open the file.
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – application crash or resource exhaustion.
• Threat Level: Medium (due to local attack vector and user interaction requirement).

Deep Dive & Mechanics

The vulnerability resides in the gf_cenc_set_pssh function within isomedia/drm_sample.c. This function is responsible for parsing and setting the Protection System Specific Header (PSSH) box, which contains DRM-related metadata. The PSSH box includes a KID (Key ID) array and a Data field. The heap buffer overflow occurs because the function does not properly validate the size of the Data field against the allocated buffer before copying data into it.

When MP4Box processes a crafted MP4 file, the gf_cenc_set_pssh function reads the PSSH box and attempts to copy the Data field into a heap buffer. If the Data size is larger than the allocated buffer, a heap buffer overflow occurs. This can corrupt adjacent heap memory, leading to a crash (DoS) or potentially arbitrary code execution if an attacker can control the overflowed data.

The vulnerable code path is triggered during the parsing of the moov box (Movie Box) and its child pssh box. The function gf_cenc_set_pssh is called to initialize the CENC (Common Encryption) structure. The overflow happens when copying the KID array or the Data field without proper bounds checking.

Vulnerable vs. Patched Code

Vulnerable Code (GPAC MP4Box v2.4):

// isomedia/drm_sample.c
GF_Err gf_cenc_set_pssh(GF_ISOFile *file, u32 pssh_type, u8 *data, u32 data_len) {
    GF_CENCPssh *pssh = gf_malloc(sizeof(GF_CENCPssh));
    if (!pssh) return GF_OUT_OF_MEM;
    pssh->KID_count = 0;
    pssh->KIDs = NULL;
    pssh->data = NULL;
    pssh->data_length = 0;

    // Parse PSSH box
    u32 pos = 0;
    // ... parsing logic ...
    // Vulnerable: no size check before memcpy
    pssh->data = gf_malloc(data_len);
    memcpy(pssh->data, data + pos, data_len); // Overflow if data_len > allocated size
    pssh->data_length = data_len;
    // ...
}

Patched Code (Hypothetical Fix):

// isomedia/drm_sample.c
GF_Err gf_cenc_set_pssh(GF_ISOFile *file, u32 pssh_type, u8 *data, u32 data_len) {
    GF_CENCPssh *pssh = gf_malloc(sizeof(GF_CENCPssh));
    if (!pssh) return GF_OUT_OF_MEM;
    pssh->KID_count = 0;
    pssh->KIDs = NULL;
    pssh->data = NULL;
    pssh->data_length = 0;

    // Parse PSSH box
    u32 pos = 0;
    // ... parsing logic ...
    // Fixed: validate data_len against remaining buffer size
    if (data_len > remaining_size) {
        gf_free(pssh);
        return GF_BAD_PARAM;
    }
    pssh->data = gf_malloc(data_len);
    if (!pssh->data) {
        gf_free(pssh);
        return GF_OUT_OF_MEM;
    }
    memcpy(pssh->data, data + pos, data_len);
    pssh->data_length = data_len;
    // ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

1. Crafting the Malicious MP4 File:

   • Use a tool like mp4box or a hex editor to create an MP4 file with a malformed PSSH box.
   • Set the data_length field in the PSSH box to a value larger than the actual allocated buffer (e.g., 0xFFFF).
   • Include a large Data field to trigger the overflow.

2. Triggering the Vulnerability:

   • Deliver the crafted MP4 file to the victim via email, download, or other means.
   • When the victim opens the file with GPAC MP4Box (e.g., MP4Box -info crafted.mp4), the heap overflow occurs, crashing the application.

3. Potential for Code Execution:

   • If the overflow can be controlled to overwrite a function pointer or return address, arbitrary code execution may be possible. This requires precise heap layout manipulation.

Blue Team (Detection & Defense)

1. Detection:

   • Monitor for crashes of MP4Box or other GPAC tools.
   • Use file integrity monitoring to detect unusual MP4 files.
   • Deploy endpoint detection and response (EDR) rules for heap corruption events.

2. Mitigation:

   • Avoid opening untrusted MP4 files with GPAC MP4Box.
   • Apply memory safety protections (ASLR, DEP, CFG) to mitigate exploitation.
   • If a patch becomes available, update GPAC immediately.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual if available)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (crafted MP4)
• Process Anomalies:
  • MP4Box.exe crash with exception code 0xc0000005 (Access Violation)
  • Heap corruption events in Windows Event Log (Event ID 1023, 1024)
• Network Indicators:
  • No network indicators; attack is local file-based.

Detection Engineering

YARA Rule

rule CVE_2025_55645_GPAC_MP4Box_HeapOverflow {
    meta:
        description = "Detects crafted MP4 files exploiting CVE-2025-55645 heap buffer overflow in GPAC MP4Box"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55645"
    strings:
        $pssh_magic = { 70 73 73 68 } // "pssh" box type
        $large_data = { FF FF 00 00 } // Example large data length (adjust as needed)
    condition:
        $pssh_magic and $large_data
}

Sigma Rule

title: CVE-2025-55645 GPAC MP4Box Heap Overflow Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes of GPAC MP4Box due to heap buffer overflow (CVE-2025-55645)
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\MP4Box.exe'
        CommandLine|contains: '.mp4'
    condition: selection
falsepositives:
    - Legitimate MP4 processing
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-55645 GPAC MP4Box Heap Overflow Attempt"; flow:to_client; file_store; fileext:"mp4"; content:"|70 73 73 68|"; distance:0; within:4; content:"|FF FF|"; distance:0; within:2; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Do not open untrusted MP4 files with GPAC MP4Box v2.4.
   • Use alternative media processing tools until a patch is available.

2. Long-Term Fix:

   • Apply input validation in gf_cenc_set_pssh to check buffer sizes before copying.
   • Use safe memory functions (e.g., memcpy_s on Windows) or bounds-checked versions.

3. Monitoring:

   • Monitor for crashes and heap corruption events.
   • Deploy the provided YARA and Sigma rules to detect malicious files.

4. Patch Status:

   • No official patch is available as of this report. Monitor GPAC's GitHub repository for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence