Skip to main content

Floating Point Comparison with Incorrect Operator

CVE-2025-55658

Medium
6.5/10

Summary

GPAC MP4Box was discovered to contain a floating point exception in the 'gf_opus_parse_packet_header()' function in 'media_tools/av_parsers.c' file. This vulnerability allows attackers to cause a Denial-of-Service (DoS) via a crafted MP4 file. This issue affects GPAC versions prior to 26.02.0 and abi-12 prior to abi-12.18.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • REQUIRED
  • NONE
  • NONE
  • HIGH

CWE-1077 - Floating Point Comparison with Incorrect Operator

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

References

Advisory Timeline

  • Published