CYBERSECURITYTRACKER
Permanent story citation

CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 11129

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file

A divide by zero vulnerability (CVE-2025-60496) exists in GPAC's MP4Box reframer when processing a crafted truncated MP4 file. The flaw was reported by Alexander A. Shvedov and assigned CVSS 3.1 score of 5.5 (Medium), with a fix committed on October 22.

Why it matters: Developers and systems using MP4Box for media processing face denial of service risk if they process untrusted MP4 files; update to the patched commit f03c946aae129980f0426d4cbae9746d0536fee6 or later.

CVEsCVE-2025-60496
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary