CVE-2025-15667 GPAC CVE debrief

Who should care

Defenders responsible for local GPAC installations, particularly those using GPAC up to 2.5-DEV, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who manage GPAC deployments. They should verify GPAC versions, apply patches, and monitor for suspicious activity.

Why it matters

CVE-2025-15667 is a low-severity vulnerability in GPAC's MP4Box component that can cause a double free on local hosts. Defenders should verify GPAC versions, apply patches, and monitor for suspicious activity.

• Potential local denial of service due to double free
• Requires verification of GPAC versions and patch status
• Local exploitation may be possible
• Patching priority for GPAC installations

Technical summary

The vulnerability affects GPAC up to 2.5-DEV, specifically in the gf_isom_nalu_sample_rewrite function of src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument can cause a double free. The attack can be launched on the local host. The vulnerability has a low CVSS score of 1.9 and requires local access to exploit. Defenders should review and apply the patch for GPAC up to 2.5-DEV and monitor local GPAC usage for suspicious activity. The vulnerability does not have any known exploits but public disclosure exists.

Defensive priority

Low-priority defensive review and patching recommended for local GPAC installations.

Recommended defensive actions

• Review and apply the patch (f29f955f2a3b5e8e507caad3e52319f961bf37bf) for GPAC up to 2.5-DEV
• Inventory GPAC installations for potential exposure
• Monitor local GPAC usage for suspicious activity
• Verify GPAC versions and patch status
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in GPAC up to 2.5-DEV. Public exploit disclosure exists but actual exploitation is not confirmed. Defenders should verify GPAC versions, apply patches, and monitor for suspicious activity. The vulnerability affects the MP4Box component and has a low CVSS score of 1.9. There is no information on known or unknown affected scope beyond local GPAC installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.