A heap buffer overflow exists in the stbl_AddSize function of the isomedia/stbl_write.c component of GPAC MP4Box v2.4. The vulnerability is triggered by processing a specially crafted MP4 file. When an attacker supplies such a file, the overflow can corrupt memory and force the application to terminate, resulting in a denial of service. The weakness corresponds to a classic heap‑based buffer overflow (CWE‑122), allowing the attacker to disrupt the availability of the MP4Box tool and any services that rely on it.

The affected product is GPAC MP4Box version 2.4. No other vendor or product listings are provided. The issue manifests only when the vulnerable MP4Box binary parses a malicious MP4 media container. Systems that expose the MP4Box functionality to untrusted input or use it in a network service are particularly at risk.

EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation in the wild. The CVSS score of 5.5 reflects a medium‑severity denial of service risk that could disrupt systems using MP4Box. Attackers can trigger the heap buffer overflow by supplying a specially crafted MP4 file to the vulnerable binary via command line, scripts or other interfaces; the overflow can corrupt memory and cause the tool to crash, leading to service interruption. Because the weakness is based on input validation failure, exploitation does not require elevated privileges and can be performed from any host that has access to the MP4Box executable.