CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
Published Oct 16, 2026
·Updated
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac() to divide by zero, terminating the process with SIGFPE.
Affected Software
7 affected components
Gpac MP4Box=2.4
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
Event History
Oct 16, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Oct 28, 2026
Data Sourced
via OSV·08:16 PM
Affected Software
Frequently Asked Questions
1
What input is required to trigger the failure?
An attacker needs to supply an MP4 file containing a crafted fraction string with a zero denominator. MP4Box must process that file for gf_parse_lfrac() to perform the division by zero.
2
What is the observed impact of successful exploitation?
The division by zero raises SIGFPE and terminates the MP4Box process. The provided information describes a denial-of-service condition.