{"id":"CVE-2025-55653","kind":"vulnerability","aliases":["CVE-2025-55653"],"related":[],"title":"GPAC MP4Box: crafted MP4 file with zero denominator crashes process","description":"GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.","summary":"GPAC MP4Box v2.4 divides by zero in gf_parse_lfrac when an MP4 file contains a zero-denominator fraction string. The process terminates with SIGFPE, which is a denial of service and not code execution.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package","self-hosted"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release in the sources\n- unknown whether the sources list a fixed version","fix":"- Move MP4Box to a release newer than `v2.4` once the vendor ships a fix\n- unknown whether the sources name a fixed version","status":"open","published_at":"2026-10-16T19:16:57+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:14:07+00:00","updated_at":"2026-10-25T04:14:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:14:07Z","model":"claude-haiku-5-5","output":{"fix":"- Move MP4Box to a release newer than `v2.4` once the vendor ships a fix\n- unknown whether the sources name a fixed version","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file with zero denominator crashes process","impact":"low","summary":"GPAC MP4Box v2.4 divides by zero in gf_parse_lfrac when an MP4 file contains a zero-denominator fraction string. The process terminates with SIGFPE, which is a denial of service and not code execution.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Processing process crashes on a crafted MP4 file, causing denial of service","analyst_note":"","how_to_check":"- Run `MP4Box -version` and compare against the fixed release in the sources\n- unknown whether the sources list a fixed version","needs_analyst":false,"not_affected_if":["trusted-input-only"],"who_is_affected":"Teams that run MP4Box v2.4 to process MP4 files from untrusted sources, such as upload pipelines or transcoding services, can have a worker crash on a crafted file. Systems that only process trusted local media are unlikely to be exposed. unknown whether other GPAC builds are affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3334,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,15A '-55653':13A,16A 'caus':92C 'code':60B 'contain':40B,68C,85C 'craft':3A,82C 'crash':9A 'cve':11A,14A 'denial':55B 'denomin':8A,44B,89C 'discov':66C 'divid':29B,97C 'except':72C 'execut':61B 'file':5A,39B,84C 'float':70C 'fraction':45B,90C 'function':78C 'gf':33B,75C,93C 'gpac':1A,17B,26B,62C 'host':25B 'lfrac':35B,77C,95C 'media':19B 'media-process':18B 'mp4':4A,38B,83C 'mp4box':2A,21B,27B,63C 'packag':22B 'pars':34B,76C,94C 'point':71C 'process':10A,20B,48B,80C,102C 'self':24B 'self-host':23B 'servic':57B 'sigfp':51B,104C 'string':46B,91C 'termin':49B,100C 'utils/error.c':79C 'v2.4':28B,64C 'zero':7A,31B,43B,88C,99C 'zero-denomin':42B,87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run MP4Box v2.4 to process MP4 files from untrusted sources, such as upload pipelines or transcoding services, can have a worker crash on a crafted file. Systems that only process trusted local media are unlikely to be exposed. unknown whether other GPAC builds are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-55653","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55653","severity":null,"published_at":"2026-10-16T19:16:57+00:00","modified_at":"2026-10-20T20:17:10+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}