PatchSiren cyber security CVE debrief

CVE-2025-55642 GPAC CVE debrief

A floating point exception vulnerability exists in GPAC MP4Box v2.4 in the avidmx_process function. This issue may impact multimedia processing systems that utilize GPAC's MP4Box tool. The vulnerability could potentially disrupt multimedia processing services and requires verification of affected GPAC MP4Box versions. Defenders should assess exposure, prioritize verification, and monitor for exploitation attempts. The CVE record and NVD entry provide details on the vulnerability, but additional information on exploitation or impact is limited.

Vendor: GPAC
Product: MP4Box
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-15
Original CVE updated: 2026-10-12
Advisory published: 2026-06-15
Advisory updated: 2026-10-12

Who should care

Defenders of multimedia processing systems that utilize GPAC's MP4Box tool should assess exposure and prioritize verification of affected versions.

Why it matters

CVE-2025-55642 is a floating point exception vulnerability in GPAC MP4Box v2.4. Defenders of multimedia processing systems should assess exposure, prioritize verification, and monitor for exploitation attempts.

Potential disruption of multimedia processing services
Need for verification of affected GPAC MP4Box versions
Possible exploitation attempts targeting vulnerable deployments

Technical summary

GPAC MP4Box v2.4 contains a floating point exception in the avidmx_process function (isomedia/isom_write.c). This vulnerability could impact multimedia processing systems that utilize GPAC's MP4Box tool. Defenders should assess exposure of GPAC MP4Box deployments, prioritize verification of affected versions, and monitor for potential exploitation attempts. The vulnerability class is a floating point exception, which may lead to potential disruption of multimedia processing services.

Defensive priority

Assess exposure of GPAC MP4Box deployments, prioritize verification of affected versions, and monitor for potential exploitation attempts.

Recommended defensive actions

Assess exposure of GPAC MP4Box deployments
Prioritize verification of affected versions
Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, additional information on exploitation or impact is limited. Defenders should verify affected GPAC MP4Box versions and monitor for potential exploitation attempts. The vulnerability exists in the avidmx_process function (isomedia/isom_write.c) of GPAC MP4Box v2.4. There is no information on known or unknown affected scope beyond the specified version.

Sources and references

Verified primary and authoritative sources

CVE-2025-55642 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-55642

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-55642 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-55642

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://infosec.exchange/@sigdevel/116736787186993437

[email protected] - Exploit, Mitigation, Patch, Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.