A null pointer dereference in the gf_isom_get_user_data_count function of GPAC MP4Box v2.4 can be triggered by a specially crafted MP4 file. The flaw causes the parser to dereference an invalid pointer, leading to a crash of the application and an interruption of service. It does not provide code execution or data exfiltration but results in loss of availability for the affected application.

The only affected product identified is GPAC MP4Box version 2.4. No other vendors or products are listed in the CNA data, so the scope is limited to this particular release and any systems that use it to process MP4 media.

The attack requires a malicious MP4 file that can be supplied by any user that can provide input to MP4Box, potentially from local or remote sources if the application accepts untrusted files. EPSS score is <1% and the flaw is not listed in CISA KEV, indicating no widespread exploitation is known. The CVSS score is 5.5, reflecting medium severity. Nonetheless, systems that routinely process MP4 files, especially in unattended or public environments, face moderate to high risk of a denial of service if a crafted file is encountered.