GPAC MP4Box version 2.4 contains a flaw in the gf_parse_lfrac function where the parser attempts to divide by zero when encountering a fraction string that has a zero denominator. The resulting floating point exception causes the process to terminate with SIGFPE, effectively crashing the application. This flaw limits an attacker to causing a denial‑of‑service by feeding a specially crafted MP4 file.

The vulnerability affects users running GPAC MP4Box version 2.4. No other product or version information is listed.

The flaw is exploit‑able by providing a crafted MP4 file to the vulnerable parser; no network or authentication prerequisites are listed, so the attack vector is inferred to be local or remote file processing. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation at the time. Because the flaw results in a program crash rather than code execution, its severity is lower than remote code execution but it can still impact availability of services that rely on MP4Box.