CVE-2025-55653 in MP4Box
Summary
by MITRE • 10/16/2026
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, terminating the process with SIGFPE.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in GPAC MP4Box version 2.4 represents a critical input validation failure within its multimedia processing engine, specifically located in the utility function responsible for parsing linear fraction values. This flaw manifests as a floating point exception triggered by the gf_parse_lfrac function found in utils/error.c. The core technical issue stems from an absence of defensive programming practices regarding denominator verification before arithmetic operations are executed. When the application processes media files containing malformed metadata or specific attribute strings, it attempts to parse numerical fractions without first ensuring that the divisor is non-zero. This lack of boundary checking allows a crafted input to bypass internal safeguards and proceed directly into division logic where mathematical constraints are violated.
From an operational perspective, this vulnerability leads to immediate process termination via a SIGFPE signal when a zero-denominator fraction string is encountered during file parsing. The impact on system stability is significant for any workflow relying on automated media processing or batch conversion using GPAC MP4Box. An attacker can exploit this by distributing maliciously crafted MP4 files that embed the specific malformed fraction data within their headers or metadata sections. Upon ingestion, whether through manual opening in a GUI interface or via command-line automation scripts, the application crashes instantly. This results in a denial of service condition for local users and potentially disrupts server-side media processing pipelines if such inputs are introduced into automated workflows without prior sanitization checks.
This vulnerability aligns with CWE-369, which describes an error condition that is not handled, specifically leading to a crash or unexpected termination due to unhandled exceptions like division by zero. Furthermore, it relates closely to CWE-20, Improper Input Validation, as the root cause lies in the failure to verify the integrity and validity of user-supplied data before its use in critical arithmetic operations. In terms of adversary behavior mapping under MITRE ATT&CK, this flaw could be leveraged within techniques associated with Initial Access or Execution phases if integrated into a broader attack chain involving social engineering or supply chain compromise, although primarily it serves as a mechanism for Denial of Service against systems dependent on robust media handling capabilities.
Mitigation strategies should focus on immediate code remediation and operational hardening. Developers must modify the gf_parse_lfrac function to include explicit checks that verify the denominator is not equal to zero before performing any division operations. If a zero value is detected, the parser should gracefully handle the error by returning an appropriate failure status or throwing a controlled exception rather than allowing the hardware-level floating point exception to terminate the process. Additionally, organizations utilizing GPAC MP4Box in production environments should implement input sanitization layers at the network perimeter or application gateway level to filter out malformed media files before they reach the vulnerable component. Updating to patched versions of GPAC as soon as they become available is essential for long-term security posture improvement.