There is a Floating‑Point Exception (FPE) in the reframer_send_packet function of the GPAC Project's MP4Box tool. The exception is triggered when the tool processes a specially crafted MP4 file, causing the program to terminate unexpectedly. This flaw falls under CWE-1077 and leads to a Denial of Service, interrupting the provided service and harming availability.

The vulnerability affects all releases of the GPAC MP4Box utility earlier than version 2.5. System administrators should determine which version of the software is installed on their infrastructure and assess whether any unpatched copies remain in use. The toolbox is widely used in media processing pipelines and could be part of a media server or consumer application.

Because the flaw is exercised via a crafted file, the attacker needs to provide the malicious MP4 to the MP4Box process. The attack vector is therefore inferred to be a local file injection or a remote delivery scenario if MP4Box is exposed to external input. The EPSS score is < 1%, the CVSS score is 5.5 indicating moderate severity, and the vulnerability is not listed in CISA KEV, so the exploitation probability cannot be quantified. Nevertheless, a Denial of Service can impact single hosts or disrupted media services, making it a relevant concern.