The vulnerability is a use‑after‑free condition in the gf_filter_pid_inst_swap function of GPAC Project/MP4Box. When the function processes a specially crafted media file, it dereferences freed memory, causing the program to crash. This results in a denial of service, disrupting any service or workflow that relies on MP4Box.

The affected product is GPAC Project's MP4Box utility. Any version earlier than 26.02.0 is vulnerable. No other vendor or product versions are affected according to the available data.

The vulnerability is local to the environment running MP4Box; it requires the attacker to supply a crafted media file to the tool. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, indicating a low to moderate risk of exploitation at present. Exploitation would lead to a crash and potential downtime but does not provide remote code execution or data disclosure.