Security readout for executives and security teams
Plain-English summary
GPAC is an open-source multimedia toolkit whose MP4Box utility contains a memory-handling flaw that can crash the program or potentially be abused when it processes a specially crafted video file. The bug only triggers on the local machine running MP4Box, so it is not a remote internet threat, but any workflow that runs MP4Box against untrusted media should be reviewed.
Executive priority
Treat as a medium-priority hygiene item rather than an emergency. Impact is limited to local crashes of MP4Box, not remote compromise, but a public PoC exists so patching should be scheduled in the next routine maintenance cycle, especially for media-processing pipelines that touch external content.
Technical view
A double free (CWE-415, CWE-119) exists in gf_isom_nalu_sample_rewrite within src/isomedia/avc_ext.c in GPAC through 2.5-DEV, reachable via the nalu_out_bs argument during MP4Box NALU sample rewriting. CVSS 4.0 scores it 4.8 with vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L and exploit maturity Proof-of-Concept. Upstream commit f29f955f2a3b5e8e507caad3e52319f961bf37bf addresses the issue.
Likely exposure
Exposure is limited to systems where MP4Box or GPAC libraries process attacker-influenced MP4/AVC content locally, such as media conversion pipelines, transcoding servers, forensic workstations, or developer toolchains. Cloud services or CI jobs that ingest user-uploaded video and shell out to MP4Box are the most realistic exposure points; end-user desktop viewers are lower risk.
Exploitation context
A public proof-of-concept file is linked in the VulDB advisory, and the CVSS vector marks exploit maturity as Proof-of-Concept. The flaw requires local access with low privileges and no user interaction. CISA KEV does not list this CVE, and no reports of active in-the-wild exploitation appear in the source bundle. Impact is limited to availability (crash), not confidentiality or integrity.
Researcher notes
Root cause is a double free of the nalu_out_bs bitstream in gf_isom_nalu_sample_rewrite. Reproduction requires the referenced PoC MP4 fed to MP4Box; use ASAN or a debug build to observe the free/free sequence. Confirm remediation by reviewing the diff at commit f29f955 and re-running the PoC. CWE-119 is listed alongside CWE-415, but the primary classification is double free (CWE-415).
Mitigation direction
- Apply upstream GPAC commit f29f955f2a3b5e8e507caad3e52319f961bf37bf or a released build that includes it.
- Until patched, avoid running MP4Box against untrusted or attacker-controlled MP4/AVC input.
- Sandbox media processing jobs so a crash cannot pivot into broader host impact.
- Restrict local access to systems running vulnerable GPAC builds to trusted users only.
- Track GPAC releases and monitor issue gpac/gpac#3403 for a tagged fix version.
Validation and detection
- Inventory hosts, containers, and pipelines that install GPAC or MP4Box and record their versions.
- Compare installed commits against f29f955f2a3b5e8e507caad3e52319f961bf37bf to confirm patch presence.
- Review CI, transcoding, and forensic workflows for MP4Box invocations on untrusted media.
- Test patched builds against the public PoC in a sandbox to confirm the crash no longer occurs.
- Add detection for MP4Box process crashes or core dumps in centralized logging.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-15667 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——VulDBCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C1.81.4VulDBCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C1.81.4VulDBAV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C3.12.9VulDBVulnerability scoring details
Base CVSS 4.0 score
4.8MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Base CVSS 3.0 score
3.3LowVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Base CVSS 2.0 score
1.7LowVector: AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-376292 | GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double freeCVE reference, VulDB · vdb-entry, technical-description
- VDB-376292 | CTI Indicators (IOB, IOC, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2025-15667 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #846839 | GPAC v0.9.0 - v2.5-DEV Double FreeCVE reference, VulDB · third-party-advisory
- https://github.com/gpac/gpac/issues/3403CVE reference, VulDB · issue-tracking
- https://github.com/TimChan2001/pocs/raw/refs/heads/main/poc-gpac-1CVE reference, VulDB · exploit
- https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bfCVE reference, VulDB · patch
- https://github.com/gpac/gpac/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.