A buffer overflow occurs within the gf_ac4_parser_bs function of GPAC Project/MP4Box. The overflow arises when parsing an AC‑4 audio stream that is not properly validated, allowing an attacker to craft a malicious file that causes the parser to read or write memory out of bounds. This defect results in an immediate denial of service by crashing the executing process or rendering the tool unusable. The weakness is an unchecked buffer operation, identified as a classic buffer overflow.

GPAC Project’s MP4Box component prior to release 2.5 is affected. No other vendors or versions are explicitly listed, but any installation running the legacy MP4Box parser and processing AC‑4 streams is susceptible.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is <1%, suggesting a low likelihood of exploitation. The vulnerability is cataloged as a local denial of service, potentially exploitable by supplying a crafted media file to the MP4Box tool. While it is not listed in the CISA KEV catalog, the absence of a broader exploitation record suggests a lower likelihood of active attacks at present. Nevertheless, the impact on application availability can be severe in environments where MP4Box is routinely run on potentially untrusted media.