CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
GPAC MP4Box divide-by-zero CVE-2025-55653 crashes the importer on crafted MP4 files with a zero-denominator fraction.
Alexander A. Shvedov disclosed CVE-2025-55653 in GPAC's MP4Box. Importing a crafted MP4 that contains an invalid fractional value with a zero denominator triggers a divide-by-zero in gf_parse_lfrac. The flaw can crash the tool; the post does not report observed exploitation.
- CVE-2025-55653 is a divide-by-zero in GPAC MP4Box.
- A crafted MP4 with a zero-denominator fraction triggers the bug.
- The fault is in gf_parse_lfrac during file import.
- The disclosure does not report in-the-wild exploitation.
- CVEs
- CVE-2025-55653
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55653 | Divide-by-zero crash in GPAC MP4Box 2.4 | 5.5 | — |
From the original article
Posted by Alexander A. Shvedov on Oct 17 Product: GPAC (MP4Box) https://infosec. exchange/@sigdevel> Description: When MP4Box imports a crafted MP4 file containing an invalid fractional value with a zero denominator in its...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.