A heap buffer overflow exists in the Opus audio stream parser component of GPAC MP4Box version 2.4. When parsing a maliciously constructed MP4 file, the overflow corrupts heap memory and causes the application to crash, interrupting service availability. The weakness is identified as CWE‑122 and does not enable code execution or privilege escalation.

The vulnerability affects GPAC MP4Box v2.4. No other vendors or product versions are listed.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at the time of this analysis. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be file‑based: an attacker must supply a crafted MP4 file to the parser, which is typically a local or controlled‑input scenario. If an attacker can deliver such a file to a system running the vulnerable tool, they can trigger a denial of service by causing the process to crash.