CVE-2025-15667: Double Free in GPAC
CVE-2025-15667 is a medium severity vulnerability in GPAC version 2.5-DEV. It involves a double free issue in the function gf_isom_nalu_sample_rewrite within the MP4Box component. The vulnerability can be triggered locally by manipulating the nalu_out_bs argument. An exploit has been publicly disclosed. A patch has been identified but no official remediation status is provided.
AI Analysis
Technical Summary
This vulnerability affects GPAC up to version 2.5-DEV in the MP4Box component's function gf_isom_nalu_sample_rewrite (src/isomedia/avc_ext.c). The issue is a double free caused by improper handling of the nalu_out_bs argument. The vulnerability requires local access to exploit and has a CVSS 4.8 (medium) score, indicating limited impact and complexity. Although a patch commit (f29f955f2a3b5e8e507caad3e52319f961bf37bf) is referenced, no official vendor advisory or remediation level is provided, so patch status is not confirmed.
Potential Impact
The double free vulnerability may lead to memory corruption or application crashes when exploited locally. There is no indication of remote exploitation or privilege escalation. The impact is limited to local users with at least low privileges and does not involve user interaction or confidentiality/integrity/availability beyond local memory corruption.
Mitigation Recommendations
A patch commit has been identified for this vulnerability, but no official vendor advisory or remediation level is available to confirm patch availability. It is recommended to apply the referenced patch (commit f29f955f2a3b5e8e507caad3e52319f961bf37bf) if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2025-15667: Double Free in GPAC
Description
CVE-2025-15667 is a medium severity vulnerability in GPAC version 2.5-DEV. It involves a double free issue in the function gf_isom_nalu_sample_rewrite within the MP4Box component. The vulnerability can be triggered locally by manipulating the nalu_out_bs argument. An exploit has been publicly disclosed. A patch has been identified but no official remediation status is provided.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects GPAC up to version 2.5-DEV in the MP4Box component's function gf_isom_nalu_sample_rewrite (src/isomedia/avc_ext.c). The issue is a double free caused by improper handling of the nalu_out_bs argument. The vulnerability requires local access to exploit and has a CVSS 4.8 (medium) score, indicating limited impact and complexity. Although a patch commit (f29f955f2a3b5e8e507caad3e52319f961bf37bf) is referenced, no official vendor advisory or remediation level is provided, so patch status is not confirmed.
Potential Impact
The double free vulnerability may lead to memory corruption or application crashes when exploited locally. There is no indication of remote exploitation or privilege escalation. The impact is limited to local users with at least low privileges and does not involve user interaction or confidentiality/integrity/availability beyond local memory corruption.
Mitigation Recommendations
A patch commit has been identified for this vulnerability, but no official vendor advisory or remediation level is available to confirm patch availability. It is recommended to apply the referenced patch (commit f29f955f2a3b5e8e507caad3e52319f961bf37bf) if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-04T05:16:18.510Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b96ef27e9c797196fcc72
Added to database: 07/06/2026, 11:52:15 UTC
Last enriched: 07/06/2026, 12:06:34 UTC
Last updated: 07/06/2026, 12:14:48 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.