A segmentation violation occurs in the gf_hevc_read_sps_bs_internal function of GPAC MP4Box v2.4 when it processes a malformed HEVC Sequence Parameter Set. The flaw causes the MP4Box process to crash, resulting in a denial of service for any operation that depends on HEVC media parsing. The vulnerability is a segmentation fault that does not allow code execution or data exfiltration.

Only GPAC MP4Box version 2.4 is affected according to the CNA data. No other versions or products have been identified as impacted. Systems that rely solely on older or newer builds of MP4Box are not vulnerable.

The CVSS score of 7.5 indicates a high level of impact and difficulty. The flaw can be triggered by supplying a malicious media file or network stream containing crafted HEVC SPS data to the MP4Box parser. While the vulnerability does not provide a path to arbitrary code execution, an attacker can disrupt service for users or automated workflows that invoke MP4Box. The absence of a KEV listing suggests that widespread exploitation has not yet been observed, but the high availability impact warrants proactive mitigation.