CVE-2025-55660

A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

• CWE-121

• https://infosec.exchange/@sigdevel/116733892068649310Exploit, Mitigation, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2026/06/13/15Exploit, Mailing List, Third Party Advisory

Published

Jun 15, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55651A NULL pointer dereference in the gf_isom_get_user_data_coun…5.5
• CVE-2025-55652A heap buffer overflow in the gf_isom_vp_config_new function…5.5
• CVE-2025-55657A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs fu…7.5
• CVE-2025-55658GPAC MP4Box v2.4 was discovered to contain a floating point …6.5
• CVE-2025-55659A NULL pointer dereference in the ctts_box_write function (i…6.5
• CVE-2025-5566A vulnerability classified as critical has been found in PHP…8.8
• CVE-2025-55661A heap buffer overflow in the Opus audio stream parser compo…5.5
• CVE-2025-55663A segmentation violation in the Track_SetStreamDescriptor fu…5.5
• CVE-2025-55664A heap buffer overflow in the m2tsdmx_send_packet function (…5.5
• CVE-2025-55668Session Fixation vulnerability in Apache Tomcat via rewrite …6.5
• CVE-2025-55669When the BIG-IP Advanced WAF and ASM security policy and a s…8.7
• CVE-2025-5567The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…5.4