The vulnerability is a heap use‑after‑free in the gf_odf_ac4_cfg_clean_list function of GPAC Project/MP4Box. When MP4Box processes a crafted AC4 file, freed memory can be accessed, potentially corrupting control flow or causing a crash, which results in a denial of service within the process handling the file.

The flaw exists in the GPAC Project's MP4Box utility, affecting all releases prior to 2.5. Users who run older versions of MP4Box that decode AC4 audio streams are potentially exposed.

The CVSS score is 5.5, and the EPSS score is less than 1%, with the vulnerability not listed in the CISA KEV catalog. This moderate CVSS rating and low EPSS indicate a moderate but unlikely exploitation risk. The description implies that an attacker must supply a malicious AC4 file to MP4Box, suggesting a local or remote file‑processing vector; exploitation likely requires access to MP4Box's input pipeline.