GPAC MP4Box version 2.4 contains a flaw in the gf_parse_lfrac function where the parser attempts to divide by zero when encountering a fraction string that has a zero denominator. The resulting floating point exception causes the process to terminate with SIGFPE, effectively crashing the application. This flaw limits an attacker to causing a denial-of-service by feeding a specially crafted MP4 file.

The vulnerability affects users running GPAC MP4Box version 2.4. No other product or version information is listed.

The flaw is exploit-able by providing a crafted MP4 file to the vulnerable parser; no network or authentication prerequisites are listed, so the attack vector is inferred to be local or remote file processing. EPSS score is less than 1 percent and the CVSS score is 5.5, indicating a moderate risk. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation at the time. Because the flaw results in a program crash rather than code execution, its severity is lower than remote code execution but it can still impact availability of services that rely on MP4Box.