Live › vulnerability › CVE-2025-55653
Go to dashboardGPAC MP4Box v2.4 divides by zero in gf_parse_lfrac when an MP4 file contains a zero-denominator fraction string. The process terminates with SIGFPE, which is a denial of service and not code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run MP4Box v2.4 to process MP4 files from untrusted sources, such as upload pipelines or transcoding services, can have a worker crash on a crafted file. Systems that only process trusted local media are unlikely to be exposed. unknown whether other GPAC builds are affected.
No product ranges from the sources yet.
MP4Box -version and compare against the fixed release in the sourcesv2.4 once the vendor ships a fixEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.
This page as .md · .json · in your agent: get_signal("CVE-2025-55653")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.