The vulnerability is a heap buffer overflow in the gf_opus_parse_packet_header function of GPAC MP4Box v2.4, caused by insufficient bounds checking when parsing the Opus packet header. An attacker who supplies a carefully crafted MP4 file can trigger the overflow and crash the program, resulting in a denial of service. This flaw is classified as CWE-122.

GPAC MP4Box from the GPAC project is affected. The description references version 2.4; users should verify whether they are running that or earlier releases of GPAC MP4Box and whether they have applied any subsequent fixes.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred from the description: an attacker would need to get GPAC MP4Box to parse a malicious MP4 file, so the attack is local or requires the file to be processed on a system running the software. No remote code execution is possible; the impact is limited to service disruption.