CVE-2025-55653: division by zero in GPAC/MP4Box when importing malformed MP4

The advisory describes CVE-2025-55653 in GPAC (MP4Box). When the tool imports an MP4 file created with an invalid fraction whose denominator is zero, a division by zero occurs, classified as CWE-369, which can cause denial of service. The source states that it affects gpac/gpac before the fix commit identified in the advisory. The CVSS 3.1 score is 5.5 (medium), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H: the attack requires local access, low complexity and low privileges, needs no user interaction and affects only availability. The reporter is credited in the original text. The content was shared in the oss-sec feed and automatically translated. To verify, search the oss-sec list for the message title in the October 2026 archive, and compare your build version with the fix commit named in the advisory in the project's official repository. For your organization the topic is secondary to privacy, but it matters if media tools process received files before they reach AI services: treat those files as untrusted and run conversion in an isolated environment.