Live › vulnerability › CVE-2025-60496
Go to dashboardA floating-point exception in GPAC's MP4Box reframer (reframer_send_packet in filters/reframer.c) is triggered by a crafted MP4 file, as described in the NVD entry. An attacker who gets MP4Box to process such a file can crash it, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media conversion or upload processing, on versions before 2.5. Systems that only process trusted local media files are less exposed. The sources do not describe exploitation beyond denial of service.
No product ranges from the sources yet.
MP4Box -version and compare against the fixed release.2.5 or later, which the sources list as the first fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
This page as .md · .json · in your agent: get_signal("CVE-2025-60496")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.