CVE-2025-55644: 
NixOS vulnerability analysis and mitigation

CVE-2025-55644 is a heap use-after-free vulnerability in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box that allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file. It affects GPAC versions prior to 26.02.0 (including the referenced v2.4). The vulnerability was reported by researcher Alexander A. Shvedov (sigdevel) and disclosed publicly on June 13, 2026 via the oss-security mailing list, with NVD publication on June 15, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Openwall oss-security, Feedly).

The root cause is a CWE-416 (Use After Free) flaw in GPAC's BIFS decoder. When MP4Box processes a crafted MP4 file containing an invalid BIFS GlobalQuantizer command, BM_ParseGlobalQuantizer() in bifs/memory_decoder.c calls gf_node_unregister() to free a 192-byte QuantizationParameter node but does not clear the stale pointer. The function subsequently calls gf_node_get_tag() on the freed pointer, resulting in a heap-use-after-free READ of size 8 at scenegraph/base_scenegraph.c:1263. Exploitation requires a local attacker to supply a crafted MP4 file and have the victim invoke MP4Box -svg on it; no authentication or special privileges are required beyond file delivery. A fix commit (f5b7cdc63a7f3269040778c5431a8f6c310bc9f3) and a PoC MP4 file are publicly available (Openwall oss-security).

Successful exploitation causes the MP4Box application to crash, resulting in a Denial of Service. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability only triggers an abnormal process termination. In automated media processing pipelines where MP4Box handles untrusted files, repeated exploitation could disrupt service availability (Openwall oss-security, Feedly).

1. Craft or obtain the PoC file: Obtain the crafted MP4 file containing an invalid BIFS GlobalQuantizer command from the public PoC repository at https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/20/20_poc.mp4.
2. Deliver the file: Provide the crafted MP4 file to a target system where GPAC MP4Box (version prior to 26.02.0) is installed, via email attachment, file share, or any other delivery mechanism.
3. Trigger processing: Induce the victim (or an automated pipeline) to run ./MP4Box -svg ./20_poc.mp4, which initiates BIFS command list decoding during the SVG scene dump.
4. Trigger the use-after-free: During decoding, BM_ParseGlobalQuantizer() frees the QuantizationParameter node via gf_node_unregister() but retains the stale pointer, then calls gf_node_get_tag() on the freed memory, causing a heap-use-after-free crash and DoS (Openwall oss-security).

• Process: MP4Box process terminating abnormally or with a segmentation fault/crash when processing MP4 files, particularly when invoked with the -svg flag.
• Logs: AddressSanitizer output (if enabled) reporting heap-use-after-free at scenegraph/base_scenegraph.c:1263 in gf_node_get_tag, called from BM_ParseGlobalQuantizer in bifs/memory_decoder.c:181.
• File System: Presence of unexpected or externally sourced MP4 files (e.g., 20_poc.mp4 or similarly named files) in directories processed by MP4Box.
• Network: Downloads of MP4 files from untrusted or unknown sources to systems running GPAC MP4Box, especially in automated media processing workflows (Openwall oss-security).

Upgrade GPAC to version 26.02.0 or later, which includes the fix commit f5b7cdc63a7f3269040778c5431a8f6c310bc9f3. As a workaround, avoid processing MP4 files from untrusted sources with MP4Box, and implement file validation or sandboxing for any automated MP4Box workflows. Restricting the use of the -svg scene dump flag on untrusted input can also reduce exposure (Openwall oss-security, Feedly).

The vulnerability was disclosed by researcher Alexander A. Shvedov via the oss-security mailing list and announced on Mastodon (infosec.exchange/@sigdevel). A Bluesky post from infosec.skyfleet.blue also referenced the advisory. Coverage has been limited to security aggregators (Tenable Nessus plugin 320987, VulDB, OSV/Debian) with no major media coverage, reflecting the moderate severity and local-only attack vector (Openwall oss-security, Tenable).