CVE WatchJul 23, 2026

CVE-2025-55658

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c)

CVSS

6.5

Medium

EPSS

0.3%

p22

KEV

—

Exploit Today

0-100

Published: Jun 9, 2026 · Last modified: Jul 23, 2026 · CWE-1077

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-10-102026-11-07

Technical description

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

Official references

infosec.exchangehttps://infosec.exchange/@sigdevel/116710224797830572

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-604965.5 MED

34.8%

——10A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.11d CVE-2022-49965.3 MED

50.8%

——15A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can lead to floating point comparison with incorrect operator. It is possible to launch the attack remotely. The exploit has been published and may be used. It is best practice to apply a patch to resolve this issue.79d