GPAC MP4Box divide-by-zero on truncated MP4 (CVE-2025-60496)
Original title: CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file
A local user opening a crafted file can crash MP4Box; CVSS 3.1 is 5.5 and a fix commit is named.
Alexander A. Shvedov reported a divide-by-zero in GPAC MP4Box reframer_send_packet() on a crafted truncated MP4 file. The issue is CWE-369 and scored CVSS 3.1 5.5 medium, requiring local access and user interaction, with high availability impact only. The affected revision is 2.5-DEV-rev1780-g50b5741f2-master; the stated fix is commit f03c946aae129980f0426d4cbae9746d0536fee6.
Unconfirmed: The post does not say whether the crash is exploited outside the reporter's proof.
- Affected commit is 50b5741f291126b610c59db433fc02e8a17f0c5d.
- Fixed commit is f03c946aae129980f0426d4cbae9746d0536fee6.
- CVSS vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
- Impact is a crash, with no confidentiality or integrity loss stated.
Impact: local denial of service by crashing MP4Box
| Product | Affected | Fixed in |
|---|---|---|
| GPAC MP4Box | 2.5-DEV-rev1780-g50b5741f2-master | f03c946aae129980f0426d4cbae9746d0536fee6 |
- 1.Update GPAC to commit f03c946aae129980f0426d4cbae9746d0536fee6.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-60496 | A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a… | 5.5 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 50b5741f291126b610c59db433fc02e8a17f0c5d | (MP4Box) Affected: 2.5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: f03c946aae129980f0426d4cbae9746d0536fee6 CVE: CVE-20 |
| sha1 | f03c946aae129980f0426d4cbae9746d0536fee6 | ster Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: f03c946aae129980f0426d4cbae9746d0536fee6 CVE: CVE-2025-60496 CWE: CWE-369 (Divide By Zero) CVSS 3.1: |
From the original article
Posted by Alexander A. Shvedov on Oct 22 Product: GPAC (MP4Box) Affected: 2. 5-DEV-rev1780-g50b5741f2-master Commit 50b5741f291126b610c59db433fc02e8a17f0c5d Fixed: f03c946aae129980f0426d4cbae9746d0536fee6 CVE: CVE-2025-60496 CWE: CWE-369 (Divide By Zero) CVSS 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.