CVE-2025-55658

Executive Summary

CVE-2025-55658 is a Denial of Service (DoS) vulnerability in GPAC MP4Box v2.4, specifically within the gf_opus_parse_packet_header function in media_tools/av_parsers.c. The vulnerability is triggered by a crafted MP4 file that causes a floating point exception (FPE), leading to a crash. This issue affects the GPAC multimedia framework, which is widely used for MP4 file processing and analysis. The CVSS score is 0.0 due to incomplete NVD data, but the vulnerability is classified as a DoS with a local attack vector requiring user interaction. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must provide a crafted file to the victim.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – The application crashes, causing a DoS.

Threat Level: Medium (due to DoS impact and user interaction requirement).

Deep Dive & Mechanics

The vulnerability resides in the gf_opus_parse_packet_header function within media_tools/av_parsers.c. This function is responsible for parsing Opus audio packet headers in MP4 files. A floating point exception occurs when the function attempts to perform a division or other floating-point operation with an invalid operand (e.g., division by zero or invalid mathematical operation) due to malformed input from a crafted MP4 file.

The root cause is insufficient input validation. The function does not properly check for edge cases in the packet header data, such as zero values or out-of-range parameters, leading to an FPE. This results in a crash of the MP4Box application, causing a Denial of Service.

Vulnerable vs. Patched Code

Vulnerable Code (v2.4): The vulnerable code in gf_opus_parse_packet_header likely lacks checks for zero or invalid values before performing floating-point operations. For example:

// Vulnerable: No validation of 'sample_rate' or 'duration'
float duration_sec = (float)packet->duration / (float)packet->sample_rate;

Patched Code (Hypothetical): A patch would add validation to ensure denominators are non-zero and values are within expected ranges:

// Patched: Validate before division
if (packet->sample_rate == 0) {
    return -1; // Error handling
}
float duration_sec = (float)packet->duration / (float)packet->sample_rate;

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install GPAC MP4Box v2.4 on a test system (e.g., Ubuntu 22.04).
2. Create a crafted MP4 file with a malformed Opus packet header that triggers the FPE.
3. Execute the exploit:

   MP4Box -info crafted.mp4
   

4. Observe the crash (DoS).

Exploit Code: No public exploit code is available. A proof-of-concept would involve crafting an MP4 file with an Opus packet header containing a zero sample rate or invalid duration.

Blue Team

Detection:

• Monitor for crashes of MP4Box processes.
• Use file integrity monitoring to detect crafted MP4 files.
• Implement behavioral analysis for abnormal MP4Box behavior.

Mitigation:

• Restrict execution of MP4Box to trusted users.
• Use sandboxing or containerization for MP4Box processes.
• Apply input validation at the network perimeter if MP4 files are uploaded.

Indicators of Compromise (IOCs)

• File Hashes: (Example) SHA256 of crafted MP4 file: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Name: MP4Box crashing with signal SIGFPE (floating point exception).
• Log Entries: Application crash logs containing gf_opus_parse_packet_header and FPE errors.
• Network: No network indicators (local file-based attack).

Detection Engineering

YARA Rule

rule CVE_2025_55658_GPAC_Opus_FPE {
    meta:
        description = "Detects crafted MP4 files exploiting CVE-2025-55658"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55658"
    strings:
        $opus_magic = "OpusHead"
        $fpe_trigger = { 00 00 00 00 } // Example: zero sample rate
    condition:
        $opus_magic and $fpe_trigger
}

Sigma Rule

title: GPAC MP4Box Floating Point Exception
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes of MP4Box due to FPE in gf_opus_parse_packet_header
author: Valters IT
logsource:
    category: application
    product: linux
detection:
    selection:
        EventID: 11 // Example: Application crash event
        Image: '*MP4Box*'
        Details: '*SIGFPE*'
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55658 GPAC MP4Box FPE Attempt"; flow:to_server; file_data; content:"OpusHead"; distance:0; within:8; content:"|00 00 00 00|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Avoid processing untrusted MP4 files with GPAC MP4Box v2.4.
• Short-term: Apply input validation patches if available, or use a workaround to sanitize MP4 files before processing.
• Long-term: Upgrade to a patched version of GPAC when available. Monitor the GPAC repository for updates.
• Compensating Controls: Use application whitelisting, sandboxing, and crash monitoring to limit impact.

Valters IT signature: This report is generated for educational and defensive purposes. All information is based on publicly available data and analysis.