CVE-2025-55642 Overview
CVE-2025-55642 affects GPAC MP4Box version 2.4, an open-source multimedia framework widely used for processing MP4 and other ISO base media files. The vulnerability is a floating point exception in the avidmx_process function located in isomedia/isom_write.c. Processing a crafted media file triggers a divide-by-zero condition that crashes the MP4Box process. The flaw maps to [CWE-369: Divide By Zero] and impacts availability without affecting confidentiality or integrity. Exploitation requires the victim to open or process an attacker-supplied file, making the issue most relevant to automated media pipelines and workstations that handle untrusted content.
Critical Impact
Attackers can crash GPAC MP4Box by supplying a malformed media file, disrupting media processing workflows and automated transcoding services.
Affected Products
- GPAC MP4Box version 2.4
- GPAC multimedia framework (isomedia component)
- Applications and pipelines embedding the affected GPAC library
Discovery Timeline
- 2026-06-15 - CVE-2025-55642 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55642
Vulnerability Analysis
The defect resides in avidmx_process inside isomedia/isom_write.c. The function performs arithmetic on values parsed from an input media container without validating that divisor operands are non-zero. When a crafted file supplies a zero-valued field used as a denominator, the processor raises a floating point exception (SIGFPE) and terminates the process. The condition is deterministic and triggered through normal file ingestion, not through privileged operations. Because GPAC is embedded in many transcoding utilities, asset pipelines, and forensic workflows, a single malformed sample can interrupt batch processing or repeatedly crash a service that auto-restarts on the same input.
Root Cause
The root cause is missing input validation on numeric fields parsed from the media container before they are used in division or modulo operations. GPAC does not enforce a non-zero precondition on the affected operand inside avidmx_process, which allows attacker-controlled metadata to drive the divisor to zero and trigger the hardware exception.
Attack Vector
The attack vector is network-adjacent in the sense that crafted files can be delivered by email, web download, or cloud upload, then processed by a vulnerable MP4Box instance. User interaction is required: a victim or an automated workflow must invoke MP4Box against the malicious file. Successful exploitation produces a denial-of-service condition with no code execution or data disclosure.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in the OpenWall OSS Security List and the InfoSec Exchange Post.
Detection Methods for CVE-2025-55642
Indicators of Compromise
- Repeated SIGFPE (signal 8) terminations of MP4Box or processes linking libgpac.
- Core dumps with the faulting frame inside avidmx_process in isom_write.c.
- Media ingestion jobs failing consistently on a specific input file with non-zero exit status.
Detection Strategies
- Monitor process exit codes and crash telemetry from media processing services for abnormal termination patterns tied to GPAC binaries.
- Inspect application and system logs (journalctl, dmesg) for traps: MP4Box entries indicating floating point exceptions.
- Hash-match or quarantine media files that have previously triggered crashes to prevent repeated processing.
Monitoring Recommendations
- Enable core dump collection on hosts running GPAC and forward crash artifacts to a centralized analysis pipeline.
- Alert on sustained crash rates of media workers, which can indicate adversarial file submissions.
- Track GPAC package versions across the fleet to confirm patched builds are deployed.
How to Mitigate CVE-2025-55642
Immediate Actions Required
- Inventory all systems running GPAC 2.4, including embedded usage inside transcoding services and developer workstations.
- Restrict MP4Box invocation to trusted inputs and isolate ingestion workers in sandboxes or containers with resource limits.
- Apply automatic restart policies with backoff so that a single crash-inducing file cannot cause uncontrolled process churn.
Patch Information
No fixed version is listed in the NVD entry at publication. Track the upstream GPAC project for a release that adds divisor validation in avidmx_process. Until a patched build is available, monitor the OpenWall OSS Security List for remediation guidance.
Workarounds
- Pre-validate untrusted media files with a hardened parser before passing them to MP4Box.
- Run MP4Box under a supervisor that catches SIGFPE and skips the offending file rather than retrying.
- Limit exposure by removing MP4Box from public-facing upload handlers where ingestion is not strictly required.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
