A NULL pointer dereference occurs in the gf_ac4_presentation_ch_mode function within GPAC Project's MP4Box when parsing an AC4 file. When an attacker provides a specially crafted file, the parser attempts to dereference a null pointer, resulting in a crash of the application and a denial of service for the affected system.

The vulnerability applies to the GPAC Project MP4Box tool for all releases older than 2.5. Users running versions prior to 2.5 are susceptible, while version 2.5 and later contain the patch that eliminates the null dereference.

Based on the description, it is inferred that the attack vector is delivery of a crafted AC4 file to the MP4Box parser. The flaw requires only that the target process parses an AC4 file; no elevated privileges or network access are necessary beyond file delivery. Because the exploit is straightforward—supplying a crafted file to MP4Box—the risk of exploitation is high for any environment where the tool processes untrusted media. The EPSS score is < 1% and the CVSS base score is 5.5, indicating a moderate severity. The vulnerability is not listed in CISA KEV, meaning no known public exploits are catalogued, but the local denial-of-service impact warrants prompt remediation.