A use‑after‑free issue within the gf_filter_packet_destroy function of the GPAC Project's MP4Box utility allows an attacker to force the program to crash. The flaw occurs when the tool releases a memory block that has already been freed, which can be triggered by parsing a maliciously crafted MPEG‑2 file. The resulting crash causes a denial of service but does not grant code execution or data disclosure.

All releases of GPAC Project’s MP4Box older than version 2.5 are affected. The vulnerable code is part of the open‑source media processing library that handles MP4 and MPEG streams, so any deployment that relies on these older versions and processes untrusted media is at risk.

The primary attack vector is the injection of a crafted MPEG‑2 file into MP4Box. This is inferred, as the description explains that the crash is triggered by parsing such files. Exploitation requires only the ability to supply input; it can be performed locally or remotely if a remote service accepts media uploads. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.5 indicates a moderate severity, and despite the lack of public exploitation data, the DoS that can abort media‑processing pipelines warrants prompt remediation.