Key points
- CVE-2025-60496 affects GPAC MP4Box version 2.5-DEV-rev1780-g50b5741f2-master.
- The flaw allows a local crash via a crafted truncated MP4 file.
- A fix is available in commit f03c946aae129980f0426d4cbae9746d0536fee6.
The GPAC multimedia framework includes a tool called MP4Box that processes MPEG-4 files. A specific development version, 2.5-DEV-rev1780-g50b5741f2-master, contains a flaw that crashes the program. The issue stems from how the software handles certain media inputs. A fix has been released in the project’s codebase. Teams using this specific development build should apply the update to restore stability.
In plain English
The software tries to divide a number by zero when it encounters a broken or incomplete MP4 file. This mathematical error causes the application to stop working abruptly. An attacker would need to trick a user into opening a specially crafted file. The crash denies service to the user but does not steal data or allow remote control of the system.
The background
Alexander A. Shvedov reported the issue to the oss-security mailing list on October 22. The advisory identifies the flaw as CVE-2025-60496. It maps to CWE-369, which covers divide-by-zero errors. The Common Vulnerability Scoring System rates the severity as 5.5, which is medium. The score reflects that the attack requires local access and user interaction to trigger the crash.
What changes now
Developers have merged a fix into the GPAC repository. The corrective commit is identified as f03c946aae129980f0426d4cbae9746d0536fee6. Users running the affected development version must rebuild or update their software to include this change. The fix addresses the logic error in the reframer_send_packet function. Until the update is applied, the software remains vulnerable to the crash condition described in the advisory.
Who needs to act first
Teams should prioritize systems where users frequently open media files from untrusted sources. Check whether any internal tools or workflows rely on this specific development build of MP4Box. If so, isolate those environments from external file inputs until the patch is applied. Verify that the update restores normal functionality by testing with standard media files. Back up current configurations before rebuilding the software. Monitor logs for unexpected crashes that might indicate the flaw is being triggered.
What to do and how to stay safe: GPAC
- Verify if your environment uses the affected GPAC development version.
- Apply the latest commit from the official repository to patch the flaw.
- Restrict the ability of users to open media files from unknown sources.
- Monitor application logs for sudden crashes that indicate a divide-by-zero error.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this GPAC vulnerability?
The vulnerability is identified as CVE-2025-60496.
How severe is the divide-by-zero flaw in MP4Box?
The CVSS 3.1 score is 5.5, which is rated as medium severity.
What version of GPAC is affected by this issue?
Version 2.5-DEV-rev1780-g50b5741f2-master is affected.
