The vulnerability is a NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project MP4Box prior to version 2.5. When a crafted MPEG‑4 file is processed, the dereference causes the program to crash, leading to a denial of service. This issue does not allow attackers to execute arbitrary code or acquire sensitive data, but it can render the affected application unavailable.

The GPAC Project’s MP4Box tool before release 2.5 is affected. No specific vendor or product names are listed beyond the open‑source project. All installations of MP4Box versions earlier than 2.5 that accept arbitrary MPEG‑4 files may be impacted.

A remote attacker can trigger this failure by providing a malicious MPEG‑4 file to MP4Box. The CVSS score is 5.5, and the EPSS score is < 1 %. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The potential impact is moderate availability disruption, while the likelihood of exploitation depends on the exposure of MP4Box to untrusted input. No exploit code has been documented in this advisory.