[<prev] [next>] [day] [month] [year] [list]
Message-ID: <trinity-73d3b99b-f98c-433f-9274-d9929ce5b558-1780348835736@3c-app-mailcom-bs08>
Date: Mon, 1 Jun 2026 23:20:35 +0200
From: "Alexander A. Shvedov" <shvedov@....com>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-55664: Heap-based Buffer Overflow in GPAC/MP4Box via
m2tsdmx_send_packet on crafted MPEG-2 TS file
Product: GPAC (MP4Box)
Affected: gpac/MP4Box prior to fix commit 8e3b5e1dde7b9ea041dbdc14456a5bb74a9851ea (GPAC version 2.5-DEV-rev1644-g8e3b5e1dd-master)
CVE: CVE-2025-55664
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description:
The m2tsdmx_send_packet function in filters/dmx_m2ts.c performs a memcpy whose
size argument is derived from stream-controlled PES packet data without
validation. A crafted MPEG-2 TS file with missing sync markers (0x47), corrupted
PMT descriptor sizes, PID conflicts, and packet discontinuities causes the
computed copy size to wrap to 4294967295 (0xFFFFFFFF) at line 916.
The resulting memcpy reads and writes starting one byte past the end of a
183-byte heap-allocated region, resulting in a heap buffer overflow. Due to the
write-capable nature of the oversized memcpy, arbitrary code execution cannot
be ruled out.
Crash is reproducible on the current master branch at the time of
discovery. No authentication or special privileges required beyond
ability to provide a crafted file.
Reproduction:
-Build-opts: `--static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0"` ;
-Command: ./MP4Box -dash 100 51_m2tsdmx_send_packet_filters_dmx_m2ts_c_916
Asan-log:
==294950==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x5100000006f8 at pc 0x7fc5766f2956 bp 0x7ffde8b91e70 sp 0x7ffde8b91630
==294950==The signal is caused by a READ memory access.
#0 0x7fc5766f2955 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115
#1 0x7fc57582aec6 in m2tsdmx_send_packet filters/dmx_m2ts.c:916
#2 0x7fc57582aec6 in m2tsdmx_on_event filters/dmx_m2ts.c:1164
PoC:
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/51/51_m2tsdmx_send_packet_filters_dmx_m2ts_c_916
References:
https://github.com/gpac/gpac/issues/3310
https://nvd.nist.gov/vuln/detail/CVE-2025-55664
https://www.cve.org/CVERecord?id=CVE-2025-55664
---
Best regards,
Alexander A. Shvedov
https://github.com/sigdevel
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
