CVE-2025-55642

MediumCVSS 6.5

Published: 15/06/2026(UTC)Updated: 12/10/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

41th percentile - higher than 41% of all known CVEs

Summary

In version 2.4 of GPAC MP4Box, a floating point exception was discovered in the avidmx_process function (isomedia/isom_write.c).

Risk Assessment

Exploitation of this vulnerability may lead to unexpected application crashes, potentially affecting service availability within the organization.

Recommendation

It is recommended to update GPAC MP4Box to the latest version to mitigate this vulnerability.

Other vulnerabilities in GPAC MP4Box v2.4

See all

CVE-2025-60476Medium
A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
CVE-2025-60469Medium
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
CVE-2025-60493Medium
A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
CVE-2025-60492Medium
A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a denial of service via a crafted MP4 file.
CVE-2025-60491Medium
A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before version 2.5 allows attackers to cause a denial of service (DoS) by supplying a crafted MP4 file.
CVE-2025-60490Medium
A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-60487Medium
A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.
CVE-2025-60478Medium
A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.
CVE-2025-71438Medium
An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
CVE-2025-60489Medium
A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

Original NVD description (English source)

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS