Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-55653: GPAC MP4Box can crash with a crafted MP4 file

CVE-2025-55653 · published 20 days ago

Summary

Version 2.4 of GPAC MP4Box may stop working if it opens a specially made MP4 file that contains an invalid fraction value. The problem causes the program to divide by zero and terminate, which could interrupt any workflow that relies on processing video files. Apply the latest GPAC update or avoid opening untrusted MP4 files until the fix is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:14.04:LTS	canonical	gpac	All versions

Original advisory text

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string cau...

References

https://infosec.exchange/@sigdevel/116769079013422405 URL
https://github.com/gpac/gpac/issues/3247 Third Party Advisory
https://github.com/gpac/gpac/commit/4bbb6e5 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55653... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-55653 Vendor Advisory
https://ubuntu.com/security/CVE-2025-55653 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2025-55653 Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/10/17/4 URL

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-369Divide By Zero

Timeline

Published16 Oct 2026

Updated3 Nov 2026

First seen16 Oct 2026

Sources

CVE-2025-55653 · NVD

CVE-2025-55653 · MITRE

CVE-2025-55653 · OSV

UBUNTU-CVE-2025-55653 · OSV

Track software like this

Free during beta