CVE-2025-55640: heap buffer overflow in GPAC/MP4Box when parsing MP4 with corrupted sample metadata

The advisory, posted to the oss-sec feed on 17 October, describes CVE-2025-55640 in GPAC, a package whose MP4Box utility imports MP4 files. The flaw is classified as CWE-122, heap-based buffer overflow, and occurs when MP4Box processes a file created with manipulated sample metadata, such as corrupted sample counts. The text states that exploitation may affect confidentiality, integrity and availability. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, no privileges required and user interaction required. Affected versions are those prior to the fix commit 321624f28d19a413449fd1718d1eb59037f8f7fc in the gpac/gpac repository. To consult the original, search the oss-sec feed for CVE-2025-55640 and read the full text, which contains the technical description and the reporter's credit. To verify, compare your installed MP4Box version with the fix commit in the project's official repository and confirm the change is included. The text you received is an automatic translation, so use the original for technical details. This flaw is in a multimedia tool, not in a Rota Nacional service, and the platform does not patch third-party libraries. Teams that use MP4Box in media pipelines before sending content to models should treat externally sourced files as untrusted, update the component and isolate the conversion step.