https://seclists.org/oss-sec/2026/q4/327: CVE-2025-60496: Divide by zero in GPAC/MP4Box framer via crafted truncated MP4 file
Affected Software
Frequently Asked Questions
Who is exposed to this issue?
Systems that use MP4Box to split MP4 files are exposed if they process attacker-controlled or otherwise untrusted MP4 input. The reported impact is local denial of service, and the CVSS vector requires user interaction.
What does an attacker need to do to trigger the crash?
The attacker needs to provide a crafted, truncated MP4 file and have it processed with MP4Box splitting, such as using the -split-size option. Malformed stream parameters left at zero can cause a division by zero while split boundaries are calculated.
Is arbitrary code execution known to be possible?
No. The report demonstrates a SIGFPE crash that terminates MP4Box, resulting in denial of service; arbitrary code execution was not demonstrated.
What should be done if the fix cannot be applied immediately?
Do not run MP4Box splitting operations on untrusted MP4 files until the issue is remediated. Restrict access to workflows that invoke MP4Box with splitting enabled and validate or isolate untrusted media processing where possible.
How can I determine whether my build is affected?
The issue was reproduced in GPAC 2.5-DEV-rev1780-g50b5741f2-master at commit 50b5741f291126b610c59db433fc02e8a17f0c5d. The upstream fix is commit f03c946aae129980f0426d4cbae9746d0536fee6.