A use‑after‑free flaw exists in the gf_filter_pid_get_packet function within GPAC MP4Box v2.4. When the library processes a specially crafted MP4 file, the function accesses memory that has already been freed, which can crash the application and exhaust resources, leading to a denial of service. The vulnerability is a classic use‑after‑free condition and therefore allows an attacker to terminate the media processing process and deny service to legitimate users.

GPAC MP4Box version 2.4 is affected. No additional vendor or product variants are listed. Users running this specific release and processing MP4 files from untrusted sources are at risk.

The flaw is not publicly listed in the KEV catalog and the CVSS score of 5.5 indicates moderate severity. EPSS score is < 1%, indicating a low probability of exploitation. However, the vulnerability can be triggered by supplying a crafted MP4 file to the application, implying a remote or local attack vector that requires file execution or inclusion in a processing workflow. The impact is non‑confidential but disrupts service availability for affected systems. No official patch is cited, so the risk remains until an update is applied.