CVE-2025-55642: Divide by Zero in GPAC/MP4Box via avidmx_process on crafted AVI input with zero declad frames
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmxprocess function (isomedia/isomwrite.c).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GPAC MP4Box v2.4from your environment.Uninstall GPAC MP4Box v2.4 or remove/disable the MP4Box component on affected systems until a vendor-supplied fix is available.
- Compensating control
Do not process AVI files from untrusted sources. Validate or reject AVI inputs that contain zero declad frames prior to feeding them to MP4Box. If processing untrusted files is required, run MP4Box in a sandbox or confined environment with least privileges and isolate systems that handle untrusted media until a vendor patch is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55642?
CVE-2025-55642 has a medium severity rating of 6.5.
How do I fix CVE-2025-55642?
To fix CVE-2025-55642, update GPAC MP4Box to version 2.4 or later, which addresses the divide by zero issue.
What software is affected by CVE-2025-55642?
CVE-2025-55642 affects GPAC MP4Box version 2.4 and earlier versions.
What is the main issue described in CVE-2025-55642?
CVE-2025-55642 describes a divide by zero vulnerability in the avidmx_process function of GPAC MP4Box.
When was CVE-2025-55642 published?
CVE-2025-55642 was published on June 13, 2026.