CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10589

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction

CVE-2025-55653 is a divide-by-zero vulnerability in GPAC MP4Box that can be triggered by parsing a crafted MP4 file with an invalid fraction containing a zero denominator. The flaw resides in the gf_parse_lfrac function and affects versions prior to commit 4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8. Successful exploitation causes a denial of service condition with no impact on confidentiality or integrity.

Why it matters: Multimedia processing teams and GPAC users should test and apply the fix to prevent denial of service from maliciously crafted MP4 files.

CVEsCVE-2025-55653
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary