A heap buffer overflow occurs in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box version 2.4. The flaw can be triggered by supplying a specially crafted MP4 file. When the malformed file is processed, the overflow can corrupt heap memory, causing the application to crash and leading to a denial of service. This vulnerability is classified as a heap-based buffer overflow (CWE‑122).

GPAC MP4Box version 2.4, identified by the CPE cpe:2.3:a:gpac:gpac. No other affected vendors or products are listed.

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is local file ingestion, where an attacker delivers a malicious MP4 file that the system or user processes. Exploitation would result only in service interruption, with no compromise of confidentiality or integrity.