The vulnerability is a use-after-free in the gf_filter_pid_get_packet function of GPAC Project's MP4Box. An attacker can supply a crafted media file that causes the program to dereference freed memory, leading to a crash and service interruption. This is a classic use-after-free flaw (CWE-416) that compromises the stability of the tool.

GPAC Project's MP4Box utility before version 26.02.0 is affected. All builds of MP4Box that use the gf_filter_pid_get_packet routine prior to this release are vulnerable.

The identified risk is a local denial-of-service triggered by processing a carefully designed media file. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. Because a malicious file must be provided to the MP4Box process, the attack vector is assumed to be local via crafted input. Without a published CVSS score, the severity remains unknown, but the denial-of-service can disrupt processing pipelines and services that rely on GPAC MP4Box.