{"id":"CVE-2025-55654","details":"A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.","modified":"2026-10-22T13:18:10.519376243Z","published":"2026-10-19T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55654.json","cna_assigner":"mitre"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/20/7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55654.json"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3249"},{"type":"WEB","url":"https://infosec.exchange/@sigdevel/116769098607015606"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55654"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"0ccd2927c7145f5ab0352c5b15f787757b34eb18"}],"database_specific":{"extracted_events":[{"range":[{"fixed":"0ccd2927c7145f5ab0352c5b15f787757b34eb18"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures_modified":"2026-10-22T13:18:10Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55654.json","vanir_signatures":[{"id":"CVE-2025-55654-01d74593","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filters/out_file.c"},"deprecated":false,"digest":{"line_hashes":["215454597007164580911377809439366351597","95606667192003809512959361212933224586","208913985755962027543904391779282404582"],"threshold":0.9}},{"source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filters/write_nhml.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["154722079632598601625292212205243451384","11857731599584928418270648492662152597","274443417999764689411901068943762698603","20116007641195706909490512240643651968","63387796272730057291935297879441318486","327033493311990159399741720231318798560","56415933074162279829855827978738153714","95460077104189584895865039266003479327","138561130492235528626681654298581789603","223907794568170772422221484851806011470","302386235969282289708879589097819694488","245831569466788815848289675693696988709"]},"id":"CVE-2025-55654-104bf311","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filter_core/filter_pid.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["9381945389244124107897063202909782790","39947895078158936408516576142715619473","257238630974311605257587895479094191377","13126072973798252046987375777967720232","137083443792586990913477504362825470996","266348488146517465462082734423267296675","235331726054855669575204924364183965365","17108959689645244754855522467906757659","234038118421556946719837259452265416450","164213207199503974605769995483611939666","68595286671651863682939610439245259572","309335166212705913681999615289491002237","116126902904912872456883409204249884613","59623290029972929188282169134819104836","10464759180237207621401708337759123464","49187847039969514815358268695731807343"]},"id":"CVE-2025-55654-148614ca"},{"id":"CVE-2025-55654-3db21344","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filters/write_nhml.c","function":"nhmldump_configure_pid"},"deprecated":false,"digest":{"length":3706,"function_hash":"325504109018758136874281272637049191710"}},{"id":"CVE-2025-55654-523162fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"function":"gf_filter_pid_inst_delete_task","file":"src/filter_core/filter_pid.c"},"deprecated":false,"digest":{"function_hash":"315496091543872718788781868444177891510","length":2517}},{"digest":{"function_hash":"294944065313282944843117761165249715088","length":1215},"id":"CVE-2025-55654-96f5232a","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filter_core/filter_pid.c","function":"gf_filter_pid_remove"},"deprecated":false},{"digest":{"length":1237,"function_hash":"88107828127255966066795577306278352951"},"id":"CVE-2025-55654-9e92421b","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filter_core/filter_pid.c","function":"gf_filter_pid_disconnect_task"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"325453702367484248462028640107687254918","length":3980},"id":"CVE-2025-55654-a1c49edb","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filters/out_file.c","function":"fileout_open_close"}},{"source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filter_core/filter_session.h"},"deprecated":false,"digest":{"line_hashes":["32195234171861074354718073013697220813","138390643073059310154948968548746742191","316890006287940096739709599312017789619","74205638118654058966797426460545013859"],"threshold":0.9},"id":"CVE-2025-55654-aede01d7","signature_type":"Line","signature_version":"v1"},{"digest":{"length":2117,"function_hash":"153699492632163992214405877038614478888"},"id":"CVE-2025-55654-b97a6502","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filter_core/filter_pid.c","function":"gf_filter_pid_filter_internal_packet"},"deprecated":false},{"source":"https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18","target":{"file":"src/filters/write_nhml.c","function":"nhmldump_config_side_stream"},"deprecated":false,"digest":{"function_hash":"190457621558120741400668641891732154410","length":3179},"id":"CVE-2025-55654-e95b5dca","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}