A heap buffer overflow exists in the stbl_AddSize function of the isomedia/stbl_write.c component of GPAC MP4Box v2.4. The vulnerability is triggered by processing a specially crafted MP4 file. When an attacker supplies such a file, the overflow can corrupt memory and force the application to terminate, resulting in a denial of service. The weakness corresponds to a classic heap‑based buffer overflow (CWE‑122), allowing the attacker to disrupt the availability of the MP4Box tool and any services that rely on it.

The affected product is GPAC MP4Box version 2.4. No other vendor or product listings are provided. The issue manifests only when the vulnerable MP4Box binary parses a malicious MP4 media container. Systems that expose the MP4Box functionality to untrusted input or use it in a network service are particularly at risk.

EPSS is not available for this CVE and it is not listed in the CISA KEV catalog, indicating that there is currently no evidence of exploitation in the wild. The CVSS score is not provided, but the denial of service impact could be significant for environments that rely on MP4Box for media processing. Attackers can trigger exploitation by supplying a crafted MP4 file to the vulnerable binary over an API, script, or command line. Because the vulnerability relies on input validation failure rather than privilege escalation, the attack can be carried out from anywhere the tool is accessible, making it broadly exploitable.