The vulnerability is a NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function of GPAC MP4Box before version 26.02.0. An attacker supplies a specially crafted input file that triggers the dereference, resulting in an application crash and loss of availability. No confidentiality or integrity breach is indicated; the impact is restricted to availability.

All installations of GPAC Project MP4Box that are earlier than version 26.02.0. Users of this project, regardless of deployment environment, are potentially affected.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so exploitation data is limited. Since the flaw requires a crafted file to be processed by MP4Box, the attack vector is inferred to be local or remote depending on whether MP4Box handles externally supplied input. The CVSS score is not provided, but the risk to availability can be considered moderate, with exploitation probability uncertain but possible if the application runs with untrusted input.