A NULL pointer dereference occurs in the gf_odf_ac4_cfg_dsi_v1 function within the GPAC Project MP4Box before 26.02.0. Based on the description, it is inferred that an attacker who can supply a specially crafted AC4 media file can cause the application to crash, resulting in a denial‑of‑service. The flaw does not provide code execution, data disclosure, or privileged access; it solely disrupts service availability.

All implementations of GPAC Project MP4Box older than version 26.02.0 are affected. No separate vendor or product lines are listed; the issue resides entirely in the core MP4Box binary.

The CVSS score is 5.5, and the vulnerability is not in the CISA KEV catalog, indicating no known active exploitation. Based on the description, it is inferred that the attack vector requires the attacker to deliver a malicious AC4 file to the target system, which is typically a local or privileged file injection scenario. Because the function fails when encountering malformed input, exploitation is straightforward once a suitable file is crafted, placing the risk at a moderate level for environments that routinely process untrusted AC4 streams. In tightly controlled or isolated deployments, the impact is lower.