A use‑after‑free bug has been identified in the gf_sei_load_from_state_internal function of the GPAC MP4Box tool. The flaw allows an attacker to supply a specially crafted MPEG‑2 transport‑stream file that triggers crash. The result is a denial of service, preventing legitimate users from processing media files.

The vulnerability affects the GPAC Project's MP4Box utility in all releases prior to version 26.02.0. No other vendors or products have been listed as affected by this issue.

The flaw carries a high severity impact as a failure to recover from the corrupted state will terminate MP4Box, rendering it unusable until restarted. The CVSS score is 7.8 and the EPSS probability is < 1%; the vulnerability is not currently listed in CISA's KEV catalogue. The likely attack vector involves an attacker providing the crafted MPEG‑2 TS file to a run‑time instance of MP4Box, whether locally or via a network service that accepts media inputs. Because the exploitation hinges on delivering a specific file, the risk is moderate to high depending on the exposure of the MP4Box interface.