CVE-2025-55653 Details
Description
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.
A floating point exception vulnerability has been identified in GPAC MP4Box version 2.4 and earlier. The issue arises in the 'gf_parse_lfrac' function within 'utils/error.c', where the function improperly handles fraction strings with a zero denominator. This flaw allows for a division by zero, leading to a process termination via a SIGFPE signal. The vulnerability can be exploited by processing a crafted MP4 file that contains an invalid fractional value with a zero denominator, causing an immediate crash of the MP4Box application.
Users should update to GPAC version 2.4.1 or later, which includes the fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/17/4 | CVE | |
| https://github.com/gpac/gpac/commit/4bbb6e5 | [email protected] | Source CodeVendor |
| https://github.com/gpac/gpac/issues/3247 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://infosec.exchange/@sigdevel/116769079013422405 | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-369 | Divide By Zero | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| GPAC MP4Box | <= 2.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Translated | [email protected] |
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | CVE Modified | CVE |
| Oct 16, 2026 | New CVE Received | [email protected] |