Monthly
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted MP4 file drives the reframer path to a floating-point exception, crashing the process. The issue is local-only (AV:L), requires the victim to open or process the file (UI:R), and affects availability only; environments that ingest untrusted MP4s, such as transcoding or upload pipelines, are the relevant exposure. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV status is indicated, and EPSS is low at 0.20% (9th percentile), so priority is this_month rather than emergency.
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted MP4 file drives the reframer path to a floating-point exception, crashing the process. The issue is local-only (AV:L), requires the victim to open or process the file (UI:R), and affects availability only; environments that ingest untrusted MP4s, such as transcoding or upload pipelines, are the relevant exposure. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV status is indicated, and EPSS is low at 0.20% (9th percentile), so priority is this_month rather than emergency.
Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
A floating point exception vulnerability was found in sox, in the read_samples function at sox/src/voc.c:334:18. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A floating point exception vulnerability was found in sox, in the lsx_aiffstartwrite function at sox/src/aiff.c:622:58. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available.