CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
GPAC MP4Box divide-by-zero CVE-2025-55653 crashes the importer on crafted MP4 files with a zero-denominator fraction.
20
Vulnerability2 · 2 reads
CVE-2025-55653
Divide-by-zero crash in GPAC MP4Box 2.4
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
GPAC MP4Box 2.4 has a divide-by-zero flaw in gf_parse_lfrac() in utils/error.c. A crafted MP4 whose fraction string uses a zero denominator makes that function perform a floating-point division by zero, which raises SIGFPE and terminates the process. The impact described is a crash and denial of service when the tool parses the file, not code execution or data theft. Users and media pipelines that run MP4Box 2.4 on untrusted files are affected. It is not on the CISA KEV list, CVSS is not yet scored, and no public proof-of-concept is known.
What to do: Treat untrusted MP4 input as unsafe on GPAC MP4Box 2.4 and do not process it in automated pipelines until the package is updated. Check the GPAC project advisories or release notes for a build that fixes CVE-2025-55653; the available data names only 2.4 as affected and does not state a fixed version. Until then, isolate MP4Box so a crash cannot disrupt shared media workflows.
| Product | Affected |
|---|---|
| GPAC MP4Box | 2.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.
- Weakness
- CWE-369
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H