CVE-2025-60496
Awaiting Analysis Awaiting Analysis - Queue

Floating-Point Exception DoS in GPAC MP4Box

Publication date: 2026-10-20

Last updated on: 2026-10-28

Assigner: MITRE

Description
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-28
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2025-60496
EUVD
EUVD-2025-211140

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1077 The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Floating-Point Exception (FPE) in the reframer_send_packet function of the GPAC Project/MP4Box software before version 2.5. It occurs when processing a crafted MP4 file, leading to a Denial of Service (DoS) condition.

Detection Guidance

Detecting this vulnerability requires analyzing MP4 files for malformed data that triggers a Floating-Point Exception in the reframer_send_packet function. Use GPAC tools like MP4Box to parse files and check for crashes or errors when processing suspicious MP4 files.

Impact Analysis

The vulnerability allows attackers to cause a Denial of Service by crashing the affected software when processing a specially crafted MP4 file. This could disrupt services relying on GPAC Project/MP4Box for media processing.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via a crafted MP4 file, which may disrupt system availability. Compliance with standards like GDPR or HIPAA often requires maintaining system availability and integrity. A DoS could impact data processing or access, potentially violating availability requirements in these regulations.

Mitigation Strategies

Update GPAC Project/MP4Box to version 2.5 or later to address the vulnerability. Avoid processing untrusted MP4 files until patched. Monitor systems for crashes during media file processing as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-60496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...