{"id":"CVE-2025-55667","details":"A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","modified":"2026-10-22T16:08:31.369219768Z","published":"2026-10-19T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55667.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/20/8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55667.json"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3321"},{"type":"WEB","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743"},{"type":"WEB","url":"https://infosec.exchange/@sigdevel/117456648463009125"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55667"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"e6d01820d7bf3967d931fedb379ee5f209bc133b"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"e6d01820d7bf3967d931fedb379ee5f209bc133b"}]}]}}],"versions":["abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures":[{"id":"CVE-2025-55667-3b557214","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"function":"dasher_configure_pid","file":"src/filters/dasher.c"},"deprecated":false,"digest":{"length":27175,"function_hash":"199193566362182277671567014971897598992"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"applications/mp4box/filedump.c"},"deprecated":false,"digest":{"line_hashes":["18932393730742255432453235775156873288","270764964189030152645070470071380676127","203278179028737446463915301054632003726","26470146062633646409700590501854041123"],"threshold":0.9},"id":"CVE-2025-55667-44068655"},{"deprecated":false,"digest":{"line_hashes":["317538733772543257714868350721726851573","137681394362777990054220572964002058179","142975858742031049477880172076800051828","203598634951213534465747330965941789001","163716403421700846906667530234405621781","317986557153736425087238008084793996035","238519764834600678469054849651481763603","93227704173811863791141511083492932459","88791466694522139178564174306992216343","103019590927704249470899543114139376321","77841915592605315089333655969047531240","154038803093701615408291907311435998544","262975630474639848023276571725028318126","280175335559217037197328790295620441384","29261712364992840501577639974975309736","198518410689237081419018262826185960088","261003641882765732018676017977844923181","102945830147294261733650850005714985781","70196362472973435179664887836685463438","98136200847790978478183906301048952944","148220903167292014333896411881072894254","112743802115215259457116489040444028229","314290810626926821994804814259417773724","106407875581277610765102174148391597028","22108762012841155499484521830349600840","7179292035962996126116823087877580176","327611018766656538872449455059416753972","130656830246720395881826214564943429671","54622022950901821246888125045551280937","225295717380783183469772857211377099329","293423430594466348730012397236555846876","42302748561924312812961428263952810263","198699169140994778824602578411698069490","176949747484912305936256339836182072158"],"threshold":0.9},"id":"CVE-2025-55667-9537c0f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/filters/dasher.c"}},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"applications/mp4box/filedump.c","function":"dump_isom_saps"},"deprecated":false,"digest":{"function_hash":"72938795741503737622083433653794534487","length":2028},"id":"CVE-2025-55667-a29bd9f3","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/isomedia/isom_read.c"},"deprecated":false,"digest":{"line_hashes":["242170403633445511533484490383533956107","123559476618757254484850121810495946772","274232141822084879926864990161210122112","144407673426189294790732282237281067418"],"threshold":0.9},"id":"CVE-2025-55667-a5d38257"},{"deprecated":false,"digest":{"line_hashes":["123651366942589291184106866356819776233","309068702292035141079474280135500620950","146885122247678406655456477415361815509","206138803660333225707896228933792087808"],"threshold":0.9},"id":"CVE-2025-55667-a788a807","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c"}},{"target":{"file":"src/isomedia/isom_read.c","function":"gf_isom_get_esd"},"deprecated":false,"digest":{"function_hash":"312013340158895046591627719361534586937","length":319},"id":"CVE-2025-55667-b16f5372","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b"},{"source":"https://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b","target":{"file":"src/compositor/mpeg4_geometry_ifs2d.c","function":"TraverseIFS2D"},"deprecated":false,"digest":{"function_hash":"14270339333290916441435841127438430668","length":1509},"id":"CVE-2025-55667-c80451ae","signature_type":"Function","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-22T16:08:31Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-55667.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}