CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction

Summary by Cyber Security News17 Oct 2026, 21:49 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/218

Posted by Alexander A. Shvedov on Oct 17 Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (4bbb6e5f7cb827e56f32b2f7a5918b0b8e395eb8) CVE: CVE-2025-55653 CWE: CWE-369 (Divide by Zero) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Reporter: @sigdevel (Alexander Shvedov) Description: When MP4Box imports a crafted MP4 file containing an invalid fractional value with a zero denominator in its...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.