CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2026-46471

A flaw was found in gstreamer1-plugins-good. An out-of-bounds read vulnerability exists in the isomp4 plugin when parsing custom metadata in MP4 files. By tricking a user or service into processing a specially crafted MP4 file, a remote attacker could cause the application to read past the end of...

CVE-2026-105273

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input...

CVE-2026-105273

The J4Care dcm4che software contains a vulnerability where the MP4Parser fails to adequately validate MP4 box sizes . A malformed box can cause the parser to make no forward progress, resulting in a loop with an unreachable exit condition (CWE-835). This flaw can lead to high availability impact ...

EUVD-2026-102892

MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input...

CVE-2025-55640

A heap buffer overflow exists in the stbl_AddSize function (located in isomedia/stbl_write.c) of GPAC MP4Box v2.4 . This vulnerability allows an attacker to trigger a Denial of Service (DoS) by providing a crafted MP4 file . While the root cause is a heap-based overflow, the documents do not prov...

PT-2026-115618

Name of the Vulnerable Software and Affected Versions MP4Parser affected versions not specified Description MP4Parser fails to properly validate MP4 box sizes. This allows a malformed box to cause the parsing process to stall, resulting in no forward progress as the system repeatedly processes th...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211111

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-116125

🚨 CVE-2025-55640 A heap buffer overflow in the stbl AddSize function isomedia/stbl write.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file. 🎖@cveNotify...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Infinite loop

Overview tinytag is a Read audio file metadata Affected versions of this package are vulnerable to Infinite loop via the traverseatoms method in tinytag.py when parsing a malformed MP4 file. An attacker can supply an MP4 file containing an atom with an invalid or zero size value, causing the pars...

Astra Linux – Vulnerability in gst-plugins-good1.0

In GStreamer through 1.26.1, the isomp4 plugin’s qtdemuxparsetree function may read past the end of a heap buffer while parsing an MP4 file, resulting in information disclosure...

CVE-2026-107678

A flaw was found in FFmpeg. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted MP4 media file containing an excessive number of encryption metadata structures. When the application recursively frees these structures, it exhausts available stack...

CVE-2026-107390

music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the MP4 parser accepts an attacker-controlled 64-bit extended atom size, converts it to a JavaScript Number, and uses the resulting payload length for atom-specific readToken calls before proving that the atom...

CVE-2026-107391

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

NPM: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop DoS — unreleased regression on master vulnerability discovered by ? in WordPress Npm music-metadata versions 11.16.0...

CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

EUVD-2026-95245

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107391 music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on master

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...