A heap buffer overflow occurs in the m2tsdmx_send_packet function of GPAC MP4Box when processing a crafted MP4 file. This vulnerability can cause the application to crash, resulting in a denial of service for users relying on that instance of MP4Box. The weakness is a classic heap‑based buffer overflow that allows an attacker to corrupt memory layout and trigger abnormal termination.

The affected product is GPAC MP4Box version 2.4. No other vendors or product variants are listed as impacted. Users running this specific version of GPAC MP4Box should verify whether their installations match the vulnerable build.

The CVE has a CVSS score of 5.5, no EPSS value is available, and it is not listed in the CISA KEV catalog, indicating no publicly confirmed exploitation yet. The attack requires an attacker to supply a malicious MP4 file that the target system processes with MP4Box. This could be delivered via file sharing, web download, or an internal network. Because the vulnerability causes an application crash rather than privilege escalation, the impact is limited to disruption of service rather than compromise of data or system control. Nevertheless, the lack of public exploitation data does not reduce the urgency of mitigation, as a local or remote user could trigger the DoS by submitting a crafted file to a system that automatically processes MP4Box input.