The vulnerability is a heap use‑after‑free triggered in the gf_odf_ac4_cfg_clean_list function in gpac's odf/descriptors.c. When MP4Box processes a specially crafted AC4 file, it frees memory that is still in use, causing the program to crash. This results in a denial of service, interrupting any session that relies on MP4Box to read or convert AC4 streams.

The flaw appears in the GPAC Project's MP4Box build identified as 2.5‑DEV‑rev1593‑gfe88c3545‑master. Any deployment that uses this version or later unpatched builds is susceptible; the flaw originates from the core MP4Box component that handles AC4 descriptors.

The likely attack vector is the ingestion of a crafted AC4 file into MP4Box, as inferred from the description. The CVSS score of 5.5 indicates a medium risk for availability. The EPSS score is <1%, indicating a very low likelihood of exploitation. The vulnerability can be triggered by feeding the weaponized AC4 file to MP4Box, which may be executed locally on a workstation or remotely if the tool is exposed through a server or media processing pipeline. The fault does not appear to grant code execution or data exfiltration, but it can bring down processing services that rely on MP4Box.