CVE-2025-55653: division by zero in GPAC/MP4Box when importing malformed MP4 files
The oss-sec advisory describes a division by zero in GPAC's MP4Box triggered by an MP4 file with a zero-denominator fraction, leading to denial of service. The severity is medium (CVSS 3.1: 5.5).
Source: CVE-2025-55653: divisão por zero no GPAC/MP4Box ao processar MP4 criado para explorar gf_parse_lfrac (seclists.org). Text prepared with AI from this source.
What happened and what to do
The advisory, published on 17 October by Alexander A. Shvedov on the oss-sec list, covers CVE-2025-55653 (CWE-369, division by zero) in GPAC (MP4Box). When MP4Box imports an MP4 file created with an invalid fraction whose denominator is zero, processing can fail and take the service down. The CVSS 3.1 score is 5.5 (medium), with impact limited to availability. Versions prior to the fix commit 4bbb6e5f are affected.
For a company, the first step is to inventory where GPAC/MP4Box runs: transcoding workers, upload pipelines, media containers and internal tools. Next, update to a build that includes the fix. Where updating takes time, the processing of files supplied by third parties can be isolated in disposable workers with time and memory limits, and MP4 structure can be validated before import. Simple monitoring of restarts and failures in those workers helps detect exploitation attempts.
How the consultancy can help
Wendelmaques can diagnose where GPAC/MP4Box is used in your infrastructure, measure exposure to externally supplied files and propose a remediation plan. It then implements the controlled update, the isolation of media processing and failure monitoring, on your own infrastructure.
Next step
If your company processes videos or MP4 files from third parties, send a short description of your setup (where MP4Box runs, file volume and source) and receive a scoped proposal.
Let's assess your project
I reply with scope and a proposal.