GPAC MP4Box Divide-by-Zero Flaw Crashes Media Tool on Crafted Input
A medium-severity vulnerability in GPAC allows attackers to crash MP4Box by supplying files with invalid fractional denominators, requiring local access.
Key points
- CVE-2025-55653 affects GPAC versions prior to the specific fix commit.
- The flaw is a divide-by-zero error triggered by crafted MP4 files.
- CVSS score is 5.5, rated Medium severity due to local access requirements.
A divide-by-zero vulnerability in the open-source GPAC multimedia framework allows attackers to crash the MP4Box utility. The issue arises when the tool processes crafted MP4 files containing invalid fractional values with a zero denominator. This defect impacts environments where users import untrusted media files, potentially leading to denial of service for the application.
Root cause
The vulnerability stems from insufficient validation in the `gf_parse_lfrac` function within GPAC. When MP4Box imports a specially crafted MP4 file, it encounters a fractional value where the denominator is zero. The code attempts to perform division using this zero value, resulting in a divide-by-zero error. This causes the application to terminate unexpectedly, crashing the process rather than handling the invalid input gracefully.
Attack path
An attacker must provide a malicious MP4 file to a user running a vulnerable version of MP4Box. The victim must then open or import this crafted file into the application. Because the CVSS vector specifies local access, the attacker cannot trigger the crash remotely over a network. The attack requires the victim to actively process the file, making social engineering or file drop techniques likely delivery methods for the malicious media.
Affected versions
- All versions of GPAC prior to the fix commit 4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8.
- Specifically, builds of MP4Box that include the unfixed `gf_parse_lfrac` logic.
- The advisory notes the issue was reported by Alexander A. Shvedov.
Mitigation
- Update GPAC to a version that includes commit 4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8.
- Verify that your build of MP4Box has been recompiled with the patched source code.
- Avoid opening MP4 files from untrusted or unknown sources in vulnerable environments.
- Restrict execution of MP4Box to trusted directories with limited user permissions.
Detection notes
Security teams should monitor for unexpected process terminations of media conversion tools. Check system logs for crash reports associated with MP4Box or GPAC binaries. Look for patterns where users attempt to open specific media files followed immediately by application failure. Investigate any anomalous file downloads that match the profile of crafted media. Containment involves isolating affected workstations and removing the malicious files to prevent repeated crashes.
What to do and how to stay safe: GPAC
- Audit your environment for installations of GPAC or MP4Box older than the patched commit.
- Implement file integrity monitoring on media processing tools to detect unauthorized changes.
- Educate users to avoid opening media files from unverified email attachments or links.
- Once the vendor provides an update, apply the patch immediately to vulnerable systems.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2025-55653?
The CVSS 3.1 score is 5.5, which is rated as Medium severity.
Does this vulnerability allow remote code execution?
No, the vulnerability causes a crash (denial of service) and requires local access.
Who reported this vulnerability?
Alexander A. Shvedov, also known as @sigdevel, reported the issue.
