https://seclists.org/oss-sec/2026/q4/218: CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
Published Oct 17, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box
Frequently Asked Questions
1
Who can exploit this issue in practice?
An attacker needs only to provide a crafted MP4 file for MP4Box to import. No authentication or special privileges are required beyond the ability to supply that file.
2
What is the impact of successful exploitation?
Processing the crafted file triggers a floating-point exception and immediately terminates the MP4Box process. The reported impact is denial of service, with no confidentiality or integrity impact listed.
3
How can I determine whether my GPAC installation is affected?
GPAC versions prior to commit 4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8 are affected. The issue was reproducible on the current master branch at the time of discovery.
4
What can be done until the fix is deployed?
Do not import MP4 files from untrusted sources with MP4Box, since exploitation requires a crafted input file. Restricting who can provide files for MP4Box processing reduces exposure.