A memory buffer overrun in the dump_isom_saps function of GPAC MP4Box can be triggered by feeding a specially crafted MP4 file. The overflow leads to a segmentation fault that crashes the MP4Box process, resulting in denial of service for any media processing pipeline that relies on the tool. The weakness is classified as CWE-119: Improper Restriction of Operations within the Bounds of a Buffer. No evidence indicates that the flaw could lead to information disclosure or arbitrary code execution.

GPAC MP4Box, specifically the development build revision 1672 (v2.5-DEV-rev1672-gc9a31d0e1-master). No other vendors or product versions are known to be affected. The vulnerability resides in the filedump.c module that parses ISOM/SAPS boxes.

The CVSS base score is 5.5, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious MP4 file that is processed by MP4Box, so an attacker must have access to the environment where the tool runs or influence a trusted user to supply a crafted file. Given the lack of public exploitation reports and the non-interactive nature of the attack, the likelihood of real-world incidents appears limited, yet the impact remains a service interruption for affected media workflows.