CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata

Summary by Cyber Security News17 Oct 2026, 17:19 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/216

Posted by Alexander A. Shvedov on Oct 17 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (321624f28d19a413449fd1718d1eb59037f8f7fc) CVE: CVE-2025-55640 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: @sigdevel (Alexander Shvedov) Description: When MP4Box imports a crafted MP4 file containing manipulated sample metadata (corrupted sample counts,...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.