PatchSiren cyber security CVE debrief

CVE-2025-55657 GPAC CVE debrief

CVE-2025-55657 is a HIGH severity vulnerability in GPAC MP4Box v2.4. A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The vulnerability has a CVSS score of 7.5 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2025-55657).

Vendor: GPAC
Product: MP4Box
CVSS: HIGH 7.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-09
Original CVE updated: 2026-06-12
Advisory published: 2026-06-09
Advisory updated: 2026-06-12

Who should care

Users of GPAC MP4Box v2.4 should update to a patched version to prevent potential Denial of Service (DoS) attacks.

Technical summary

The vulnerability is caused by a NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4. This can be exploited by supplying a crafted MP4 file, potentially leading to a Denial of Service (DoS).

Defensive priority

HIGH

Recommended defensive actions

Update GPAC MP4Box to a patched version.
Restrict access to MP4Box to trusted sources only.
Monitor for suspicious MP4 file uploads or processing.

Evidence notes

The vulnerability is confirmed by the official CVE record [cve-org](https://www.cve.org/CVERecord?id=CVE-2025-55657) and NVD detail [nvd](https://nvd.nist.gov/vuln/detail/CVE-2025-55657).

Official resources

CVE-2025-55657 CVE record
CVE.org
CVE-2025-55657 NVD detail
NVD
Source item URL
nvd_modified
Mitigation or vendor reference
[email protected] - Exploit, Mitigation, Third Party Advisory

CVE-2025-55657 was published on 2026-06-09T19:17:31.410Z and modified on 2026-06-12T16:45:41.057Z.