CVE-2025-55654

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-55654
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55654.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-55654
Published
2026-10-19T00:00:00Z
Modified
2026-10-22T13:18:10Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55654.json"
}
References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0ccd2927c7145f5ab0352c5b15f787757b34eb18
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "0ccd2927c7145f5ab0352c5b15f787757b34eb18"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
abi-12
abi-12.*
abi-12.16
abi-12.17
abi-12.18
abi-12.19
abi-12.20
abi-12.21
abi-12.22
abi-12.23
testtag0.*
testtag0.1
v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55654.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "215454597007164580911377809439366351597",
                "95606667192003809512959361212933224586",
                "208913985755962027543904391779282404582"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-55654-01d74593",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filters/out_file.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "154722079632598601625292212205243451384",
                "11857731599584928418270648492662152597",
                "274443417999764689411901068943762698603",
                "20116007641195706909490512240643651968",
                "63387796272730057291935297879441318486",
                "327033493311990159399741720231318798560",
                "56415933074162279829855827978738153714",
                "95460077104189584895865039266003479327",
                "138561130492235528626681654298581789603",
                "223907794568170772422221484851806011470",
                "302386235969282289708879589097819694488",
                "245831569466788815848289675693696988709"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-55654-104bf311",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filters/write_nhml.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "9381945389244124107897063202909782790",
                "39947895078158936408516576142715619473",
                "257238630974311605257587895479094191377",
                "13126072973798252046987375777967720232",
                "137083443792586990913477504362825470996",
                "266348488146517465462082734423267296675",
                "235331726054855669575204924364183965365",
                "17108959689645244754855522467906757659",
                "234038118421556946719837259452265416450",
                "164213207199503974605769995483611939666",
                "68595286671651863682939610439245259572",
                "309335166212705913681999615289491002237",
                "116126902904912872456883409204249884613",
                "59623290029972929188282169134819104836",
                "10464759180237207621401708337759123464",
                "49187847039969514815358268695731807343"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-55654-148614ca",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_pid.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "325504109018758136874281272637049191710",
            "length":  3706
        },
        "id":  "CVE-2025-55654-3db21344",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filters/write_nhml.c",
            "function":  "nhmldump_configure_pid"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "315496091543872718788781868444177891510",
            "length":  2517
        },
        "id":  "CVE-2025-55654-523162fa",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_pid.c",
            "function":  "gf_filter_pid_inst_delete_task"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "294944065313282944843117761165249715088",
            "length":  1215
        },
        "id":  "CVE-2025-55654-96f5232a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_pid.c",
            "function":  "gf_filter_pid_remove"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "88107828127255966066795577306278352951",
            "length":  1237
        },
        "id":  "CVE-2025-55654-9e92421b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_pid.c",
            "function":  "gf_filter_pid_disconnect_task"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "325453702367484248462028640107687254918",
            "length":  3980
        },
        "id":  "CVE-2025-55654-a1c49edb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filters/out_file.c",
            "function":  "fileout_open_close"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "32195234171861074354718073013697220813",
                "138390643073059310154948968548746742191",
                "316890006287940096739709599312017789619",
                "74205638118654058966797426460545013859"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-55654-aede01d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_session.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "153699492632163992214405877038614478888",
            "length":  2117
        },
        "id":  "CVE-2025-55654-b97a6502",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filter_core/filter_pid.c",
            "function":  "gf_filter_pid_filter_internal_packet"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "190457621558120741400668641891732154410",
            "length":  3179
        },
        "id":  "CVE-2025-55654-e95b5dca",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/gpac/gpac/commit/0ccd2927c7145f5ab0352c5b15f787757b34eb18",
        "target":  {
            "file":  "src/filters/write_nhml.c",
            "function":  "nhmldump_config_side_stream"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T13:18:10Z"