CVE-2025-55642: GPAC MP4Box Floating Point Exception Denial of Service

Technical summary

CVE-2025-55642 is a floating point exception vulnerability in GPAC MP4Box v2.4, specifically within the avidmx_process function located in isomedia/isom_write.c. The flaw is classified as CWE-369 (Divide by Zero), a subset of improper numeric handling. The vulnerability is triggered during MP4 file processing when the application encounters malformed or specially crafted input that causes a division by zero or equivalent floating point operation to fail. The attack vector is network-based with low complexity and requires user interaction to open a malicious file, but no authentication or special privileges are needed.

Business impact

For organizations relying on MP4Box for video transcoding, format conversion, or media pipeline automation, this vulnerability introduces availability risk. A single malicious file could halt batch processing workflows, delay content publishing timelines, or crash unattended encoding services. The impact is primarily operational rather than confidential or integrity-focused—no user data is at risk, but service disruption is the concern. Media production, broadcast, and streaming companies should assess whether MP4Box is embedded in critical automation paths.

Affected systems

GPAC MP4Box version 2.4 is confirmed affected. Users of earlier or later versions should verify against official GPAC release notes and security advisories to determine the exact affected and patched versions. MP4Box is often integrated into third-party media software, container applications, and custom video processing pipelines; check your toolchain dependencies.

Exploitability

Exploitation is straightforward: an attacker must craft a malicious MP4 file and deliver it to a target user or system for processing. Since user interaction is required (opening or processing the file), this is not a wormable or automatic threat. However, in automated environments where MP4Box processes files from untrusted sources—such as user-uploaded content platforms or public APIs—the barrier to exploitation is low. No exploit code appears to be publicly documented, but the simplicity of the flaw makes weaponization trivial.

Remediation

Update GPAC MP4Box to a patched version released after this vulnerability disclosure. Verify the specific patch version against official GPAC release notes and security advisories. Until patching is complete, restrict file processing to trusted sources and implement file validation before feeding content to MP4Box. Consider running MP4Box in isolated, containerized environments to limit collateral impact from crashes.

Patch guidance

Check the official GPAC project repository and release notes for version numbers that address CVE-2025-55642. The vulnerability was disclosed on June 15, 2026 with updates through June 17, 2026; patched versions should be available shortly after. Test patches in non-production environments to ensure no regression in encoding or transcoding output quality before deployment.

Detection guidance

Monitor for unexpected crashes or exit codes from MP4Box processes, particularly when handling user-supplied or external video files. Log file processing attempts and correlate crashes with specific input files to identify patterns. If MP4Box is deployed in a container, watch for frequent restarts. File integrity monitoring on input directories may help identify suspicious files before processing. Network-based detection is limited unless you can inspect file uploads for MP4 malformation signatures.

Why prioritize this

This vulnerability scores CVSS 6.5 (MEDIUM) due to its network accessibility and ease of exploitation offset by the lack of direct data compromise and requirement for user interaction. Prioritization should reflect your use of MP4Box: critical if it processes untrusted user-uploaded content or runs in automated pipelines exposed to external input; lower priority if usage is internal-only and file sources are strictly controlled.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects an attack vector that is network-accessible (AV:N) with low attack complexity (AC:L) and no privilege or authentication requirements (PR:N, UI:R). User interaction is required, reducing the attack surface. The impact is limited to availability (A:H), with no confidentiality or integrity compromise (C:N, I:N). This places it in the MEDIUM severity band—a credible operational risk but not a critical system breach vector.

Frequently asked questions