The vulnerability resides in the TrackWriter handling component of GPAC MP4Box version 2.4. A NULL pointer dereference occurs when parsing certain MP4 files, which has been documented in filters/mux_isom.c. The flaw can be triggered by an attacker who supplies a specially crafted MP4 file to the application, leading to an application crash that results in a denial of service. This issue does not provide an attacker with code execution or data exfiltration capabilities; rather, it disrupts the availability of the service provided by MP4Box.

GPAC MP4Box version 2.4 is affected. Any deployment using this specific version should be considered at risk. No other versions have been reported to be vulnerable, and the CPE identifies the application as gpac:gpac.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog, further indicating it has not yet been widely exploited. The attack vector is inferred to be local or contextual, requiring the delivery of a malicious MP4 file to the MP4Box tool; remote exploitation would be possible only if the tool is exposed through a service that processes external files. Successful exploitation results solely in a crash that interrupts service availability, with no compromise of confidentiality or integrity.