Technical impact
A heap buffer overflow occurs in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box version 2.4. The flaw can be triggered by supplying a specially crafted MP4 file. When the malformed file is processed, the overflow can corrupt heap memory, causing the application to crash and leading to a denial of service. This vulnerability is classified as a heap‑based buffer overflow (CWE‑122).
Affected Systems
GPAC MP4Box version 2.4 is affected. No other vendors or products are listed.
Risk and Exploitability
The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local file ingestion, where an attacker delivers a malicious MP4 file that the system or user processes. Exploitation would result only in service interruption, with no compromise of confidentiality or integrity.
