CVE-2025-60496 in MP4Box
Summary
by MITRE • 10/21/2026
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within the GPAC Project, specifically affecting versions prior to 2.5 and its associated tool MP4Box, represents a critical stability issue rooted in improper handling of floating-point arithmetic during media processing operations. The core technical flaw resides within the reframer_send_packet function located in the source file filters/reframer.c. This component is responsible for managing packet reformatting and transmission logic when processing multimedia containers such as MP4 files. When an attacker supplies a specially crafted MP4 file containing malformed or edge-case metadata, the application triggers a floating-point exception during its internal calculations. In many computing environments, particularly those relying on standard IEEE 754 compliance without adequate signal handling, unhandled arithmetic exceptions result in immediate process termination via signals such as SIGFPE. This mechanism effectively allows an attacker to induce a crash simply by providing malicious input data that exploits the lack of robust error checking around mathematical operations performed during packet reframing.
From a security impact perspective, this vulnerability facilitates a Denial of Service attack against systems relying on GPAC or MP4Box for media ingestion, conversion, or streaming preparation. Because the flaw is triggered specifically through file parsing rather than network interaction in most typical deployments, it primarily affects local processing workflows where users open untrusted video files. The operational consequence is the abrupt termination of the application process, leading to data loss if unsaved work was present and disrupting any dependent services that rely on continuous media processing capabilities. While this does not directly lead to remote code execution or privilege escalation in its current manifestation, it undermines the availability guarantee required for robust multimedia infrastructure. Attackers can leverage this by distributing malicious MP4 files through email attachments, file-sharing platforms, or web uploads, waiting for a victim with vulnerable software to process them.
The technical classification of this issue aligns closely with CWE-369, which denotes Divide By Zero errors, as floating-point exceptions are frequently caused by division operations involving zero denominators or invalid operands in numerical computations. Furthermore, the exploitation vector falls under MITRE ATT&CK technique T1496, Resource Hijacking, specifically within the sub-category of Denial of Service via resource exhaustion or application crash. The lack of input validation and exception handling for arithmetic results indicates a failure to implement defensive programming practices common in secure software development lifecycles. Developers must ensure that all mathematical operations involving external data are wrapped with appropriate checks to prevent invalid states from propagating into the execution flow.
Mitigation strategies primarily involve upgrading to GPAC version 2.5 or later, where this specific flaw has been addressed through improved input validation and exception handling mechanisms within the reframer module. For environments unable to upgrade immediately, deploying a preprocessing layer that sanitizes incoming MP4 files can provide temporary relief. This involves stripping or validating metadata fields before they reach the vulnerable parser component. Additionally, configuring system-level signal handlers to catch floating-point exceptions gracefully rather than allowing them to terminate processes can serve as an operational workaround, although this may mask underlying data corruption issues. Long-term remediation requires integrating static analysis tools that detect potential arithmetic errors and enforcing code review practices focused on numerical stability in media processing libraries.