{"id":"CVE-2025-60496","kind":"vulnerability","aliases":["CVE-2025-60496"],"related":[],"title":"GPAC MP4Box: crafted MP4 file crashes the tool via floating-point exception","description":"A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.","summary":"A floating-point exception in GPAC's MP4Box reframer (reframer_send_packet in filters/reframer.c) is triggered by a crafted MP4 file, as described in the NVD entry. An attacker who gets MP4Box to process such a file can crash it, causing denial of service.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release.\n- Check whether MP4Box processes untrusted MP4 files in any pipeline or service.","fix":"- Upgrade GPAC to `2.5` or later, which the sources list as the first fixed version.","status":"open","published_at":"2026-10-20T22:17:42+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:15+00:00","updated_at":"2026-10-25T05:04:15+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:15Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade GPAC to `2.5` or later, which the sources list as the first fixed version.","reach":"unknown","title":"GPAC MP4Box: crafted MP4 file crashes the tool via floating-point exception","impact":"low","summary":"A floating-point exception in GPAC's MP4Box reframer (reframer_send_packet in filters/reframer.c) is triggered by a crafted MP4 file, as described in the NVD entry. An attacker who gets MP4Box to process such a file can crash it, causing denial of service.","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"MP4Box crashes when processing a crafted file, causing denial of service","analyst_note":"Check the NVD entry and the GPAC repository for the fixed commit and whether any exploit or crash reproducer is public.","how_to_check":"- Run `MP4Box -version` and compare against the fixed release.\n- Check whether MP4Box processes untrusted MP4 files in any pipeline or service.","needs_analyst":true,"not_affected_if":["gpac-2.5-or-later","trusted-input-only"],"who_is_affected":"Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media conversion or upload processing, on versions before 2.5. Systems that only process trusted local media files are less exposed. The sources do not describe exploitation beyond denial of service.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000607,"input_tokens":3313,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-60496':16A,19A '/filters/reframer.c':83C '2.5':88C 'allow':89C 'attack':55B,90C 'caus':67B,92C 'craft':3A,45B,101C 'crash':6A,65B 'cve':14A,17A 'denial':68B,94C 'describ':49B 'dos':97C 'entri':53B 'except':13A,30B,75C 'file':5A,47B,63B,103C 'filters/reframer.c':40B 'float':11A,28B,73C 'floating-point':10A,27B,72C 'fpe':76C 'function':82C 'get':57B 'gpac':1A,20B,32B,85C 'media':22B 'media-process':21B 'mp4':4A,46B,102C 'mp4box':2A,24B,34B,58B 'nvd':52B 'packag':25B 'packet':38B,81C 'point':12A,29B,74C 'process':23B,60B 'project/mp4box':86C 'refram':35B,36B,79C 'send':37B,80C 'servic':70B,96C 'suppli':99C 'tool':8A 'trigger':42B 'via':9A,98C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC's MP4Box on MP4 files from outside their control, such as media conversion or upload processing, on versions before 2.5. Systems that only process trusted local media files are less exposed. The sources do not describe exploitation beyond denial of service.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-60496","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60496","severity":null,"published_at":"2026-10-20T22:17:42+00:00","modified_at":"2026-10-22T21:17:14+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}