Cyber ·
CVE-2025-60496: division by zero in the GPAC/MP4Box reframer via a crafted truncated MP4 file
Advisory from the oss-sec feed on a division by zero in MP4Box (GPAC) triggered by a truncated MP4 file. CVSS 3.1 score 5.5, with high impact on availability. The affected version and the fix are identified by commit.
Advisory CVE-2025-60496, published on 22 October through the oss-sec feed, describes a division by zero (CWE-369) in MP4Box, part of the GPAC project. According to the text, the fault occurs in reframer_send_packet() when the program processes a specially crafted truncated MP4 file. The CVSS 3.1 score is 5.5 (medium), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H: local access, no privileges required, user interaction required, no stated confidentiality or integrity impact, and high availability impact.
The advisory lists the affected build 2.5-DEV-rev1780-g50b5741f2-master, corresponding to commit 50b5741f291126b610c59db433fc02e8a17f0c5d. The fix indicated is commit f03c946aae129980f0426d4cbae9746d0536fee6. To verify, consult the original advisory in the public oss-sec list archive, whose address appears in the listing itself, compare your installed version with the affected build, and confirm the fix commit is present in your source tree.
This flaw has no direct privacy angle: the description is a process interruption, with no mention of data leakage. Still, if your organization processes media files supplied by third parties, the crash risk exists. The Rota Nacional data barrier covers audio transcription and document extraction, not MP4 processing with MP4Box, so that protection must be applied in your own infrastructure.