GPAC MP4Box v2.4 contains a floating point exception in the gf_opus_parse_packet_header function of the media_tools/av_parsers.c component. When a crafted MP4 file with an Opus packet header is parsed, the exception causes the application to terminate, leading to a denial of service. The flaw does not provide a code execution or data disclosure path, but it can break media processing pipelines if the tool is critical to operations. The weakness is classified under CWE‑1077, CWE‑749 and CWE‑754.

GPAC MP4Box version 2.4 is affected. The flaw resides in the media_tools/av_parsers.c module that parses Opus packet headers within MP4 containers. No other vendors or product versions are listed as impacted. Users that rely on GPAC MP4Box for MP4 manipulation or as part of media processing workloads are at risk.

Exploit requires a crafted MP4 file with a malicious Opus packet header. Based on the description, it is inferred that the attacker could deliver the file locally to a user running MP4Box or send it through a service that automatically processes incoming MP4 files. EPSS data is not available, and the vulnerability is not listed in CISA KEV, indicating no confirmed exploitation. The CVSS score of 6.5 indicates medium severity for availability. Until an updated release or mitigation is applied, the risk remains significant.