This flaw is a null pointer dereference that occurs in the gf_odf_vvc_cfg_write_bs routine while parsing VVC descriptors in an MP4 file. When a specially crafted MP4 file is processed, the program crashes, resulting in a denial of service for the application or host. The impact is limited to the affected process, though repeated failures can lead to broader availability issues for services that rely on the tool.

The vulnerability is present in GPAC MP4Box version 2.4. No other vendors or product versions were identified. System administrators should check whether they run this specific version and, if so, consider the risk.

Based on the description, it is inferred that the attack vector is file‑based; an attacker must supply a malicious MP4 file that is parsed by MP4Box. No remote exploitation guarantees are stated, so the likely threat is local or in scenarios where untrusted media files are accepted from external sources. The EPSS score is unavailable, and the issue is not listed in CISA KEV, indicating that the vulnerability is not yet widely exploited. The CVSS score is 7.5, indicating high severity for causing a denial of service by crashing the application.