GPAC MP4Box CVE-2025-60496

Exploitation requires that a user or automated workflow process an attacker-supplied crafted MP4 file with MP4Box/GPAC before version 2.5; the trigger is a zero-valued timing denominator (cur_start.den) reaching the reframer division, per the fix commit. Limiting factors are significant: the attack is local only (AV:L - no network reachability), requires victim interaction to open/process the file (UI:R), and yields availability impact only (process crash via FPE), with no code execution, data disclosure, or integrity effect. There is no special non-default configuration needed beyond running the reframer path on the malicious file; risk concentrates in environments that ingest untrusted MP4 files (media conversion services, upload/transcoding pipelines).

This is a genuinely moderate, not high-urgency, issue and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, user-interaction-dependent availability-only flaw: an attacker cannot reach it over the network and must get a victim to process a crafted MP4 with MP4Box/GPAC. The source commit confirms the mechanism - a missing zero-check on a denominator (cur_start.den) causes a divide-by-zero Floating-Point Exception, i.e. a process crash, with no confidentiality or integrity impact. Supporting signals agree: EPSS is 0.20% (9th percentile), it is NOT on CISA KEV, and the vuln.today Decision label is 'this_month' rather than act_now/emergency. A public PoC reference exists (sigdevel pocs repo plus an upstream GitHub issue) but the input classifies it as a reference not verified as working exploit code, so active exploitation should not be assumed. Net: a real, reproducible crash bug worth patching on a normal monthly cadence, not a drop-everything priority - the ceiling is a single-process denial of service in a file-processing/transcoding context.

An attacker crafts a malformed MP4 file and gets a victim or an automated pipeline to process it with MP4Box/GPAC (before 2.5); the reframer_send_packet path hits a divide-by-zero and the process terminates with a Floating-Point Exception. A public PoC reference exists (it is not verified as working exploit code), lowering the effort to reproduce. Exploitation requires local processing of the attacker-supplied file (AV:L) and the victim action of running MP4Box on it (UI:R).