Read the docs
TI-2025-43925 Aliases CVE-2025-55653GHSA-8r7h-84x7-5m9j

Divide by zero in GPAC MP4Box lets crafted MP4 files crash it

Priority LOW 24CWE-369Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-369.

Summary

GPAC MP4Box v2.4 contains a divide by zero flaw (CWE-369) in the gf_parse_lfrac function. A fraction string with a zero denominator in a crafted MP4 file makes the function divide by zero. When a user opens such a file, the process terminates with SIGFPE, a local denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for GPAC MP4Box.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2025-55653
  2. 2026-10-18 Alias added: GHSA-8r7h-84x7-5m9j
  3. 2026-10-20 CVSS score added · CISA ADP
  4. 2026-10-20 Weakness changed · CISA ADP
  5. 2026-10-20 CISA SSVC decision points changed

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences