CVE-2025-55653
Deferred Deferred - Pending Action

Floating Point Exception in GPAC MP4Box

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: MITRE

Description
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2025-55653
EUVD
EUVD-2025-211112

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a n/a n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a floating point exception in GPAC MP4Box v2.4. It occurs in the gf_parse_lfrac function located in utils/error.c. When processing a specially crafted MP4 file containing a fraction string with a zero denominator, the function attempts to divide by zero, causing a SIGFPE signal that terminates the process.

Detection Guidance

Detecting this vulnerability requires checking for crashes or errors when processing MP4 files with GPAC MP4Box v2.4. Monitor for SIGFPE signals or application termination when handling crafted MP4 files. Test with files containing zero-denominator fractions in the lfrac field.

Impact Analysis

This vulnerability could allow an attacker to crash the MP4Box application by providing a maliciously crafted MP4 file. This denial-of-service condition could disrupt media processing workflows that rely on GPAC tools.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is a denial-of-service (DoS) condition caused by a floating point exception in MP4Box, which crashes the process but does not lead to data breaches or unauthorized access.

Mitigation Strategies

Upgrade GPAC MP4Box to a patched version that fixes the floating point exception in gf_parse_lfrac. Avoid processing untrusted MP4 files until the update is applied. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-55653. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart