GPAC MP4Box EUVD-2025-211112

Requires a victim user or automated service to process an attacker-supplied crafted MP4 file whose fraction string contains a zero denominator, parsed by gf_parse_lfrac() in GPAC MP4Box v2.4. Exploitation is LOCAL (AV:L) and gated by user interaction (UI:R) - the malicious file must be opened/processed, so there is no remote or unauthenticated network trigger. Limiting factors: impact is confined to crashing the single MP4Box process (no code execution, no confidentiality or integrity impact), and the bug is fixed by vendor commit 4bbb6e5, so patched builds are not affected.

All signals converge on this being a LOW-priority, availability-only denial-of-service issue rather than a genuine security emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: exploitation is LOCAL and requires the victim to process an attacker-supplied file (UI:R), and the only impact is a process crash (C:N/I:N/A:H), matching CWE-369 (Divide by Zero) producing SIGFPE. EPSS is very low (0.16%, 4th percentile), and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation - no public exploit identified at time of analysis. There is no privilege escalation, no code execution, and no data exposure; a single process dies and can be restarted. The one notable data conflict is the input Tags, which label this 'Information Disclosure' - that is incorrect, as the vulnerability is a pure availability/DoS flaw (C:N, I:N, A:H). A vendor fix exists (commit 4bbb6e5 adding overflow guards in gf_parse_lfrac), so remediation is straightforward. Net: a legitimately tracked bug worth patching during normal maintenance, but not an urgent, widely-weaponized threat.

An attacker crafts a malicious MP4 file embedding a fraction string with a zero denominator and distributes it to a target (email, download, or an automated media-ingestion pipeline). When a user or service processes the file with GPAC MP4Box v2.4, gf_parse_lfrac() divides by zero and the process terminates with SIGFPE. No public exploit code is identified at time of analysis, though a proof-of-concept crafted file is implied by the referenced GitHub issue; impact is limited to a crash (denial of service).