https://seclists.org/oss-sec/2026/q4/218: CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction
Published Oct 17, 2026
·Updated
Affected Software
1 affected component
Gpac MP4Box
An attacker needs only to provide a crafted MP4 file for MP4Box to import. No authentication or special privileges are required beyond the ability to supply that file.
Processing the crafted file triggers a floating-point exception and immediately terminates the MP4Box process. The reported impact is denial of service, with no confidentiality or integrity impact listed.
GPAC versions prior to commit 4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8 are affected. The issue was reproducible on the current master branch at the time of discovery.
Do not import MP4 files from untrusted sources with MP4Box, since exploitation requires a crafted input file. Restricting who can provide files for MP4Box processing reduces exposure.