CVE-2025-60496: Divide by zero in GPAC/MP4Box framer via crafted truncated MP4 file
Published Oct 20, 2026
·Updated
A Floating-Point Exception (FPE) in the reframersendpacket function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Affected Software
7 affected components
Gpac Project MP4Box<2.5
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
ubuntu/gpac*
Event History
Oct 20, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·12:00 AM
DescriptionSeverity
Data Sourced
via OSV·10:17 PM
Affected Software
Data Sourced
via NVD·10:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
MP4Box versions before 2.5 are affected when they process attacker-supplied MP4 files. The reported impact is denial of service.
2
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted MP4 file for MP4Box to process. No additional prerequisites are provided in the available data.
3
How can I determine whether I am affected?
Check the installed MP4Box version. Versions before 2.5 should be treated as affected, particularly if they process untrusted MP4 input.