The vulnerability is a heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function located in odf/descriptors.c of the GPAC Project's MP4Box component. When a malicious AC4 media file is processed, the function can overwrite adjacent heap memory, causing the application to terminate or otherwise become unresponsive, thereby denying service to legitimate users.

The flaw affects the GPAC Project and its MP4Box media processing tool. Specifically, versions up to 2.5-DEV-rev1593-gfe88c3545-master are vulnerable. No other versions or products are listed, and the CNA does not identify any additional affected builds. The affected component is the AC4 file parser within the MP4Box executable.

The risk is that an attacker who can supply a malicious AC4 file to the vulnerable MP4Box instance can trigger a crash, disrupting services that rely on media processing. The vulnerability has a CVSS score of 5.5 and an EPSS score of < 1%, indicating a moderate severity and a very low but nonzero probability of exploitation. It is not listed in CISA’s KEV catalog, so there is no publicly documented exploitation yet. The likely attack vector is local file execution by any process that can provide the AC4 file to MP4Box; the exact conditions are not detailed in the advisory, so the assessment is based on the description and must be treated as a potential local denial of service risk.