A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function of GPAC MP4Box causes a crash when a specially crafted AC4 file is processed. The failure results in a service interruption, preventing legitimate users from executing MP4Box on the affected system.

GPAC Project MP4Box versions earlier than 26.02.0 are susceptible. Users running the MP4Box command-line tool or any application that embeds MP4Box to parse or generate AC4 streams may be impacted.

The absence of remote code execution limits the threat to denial of service, but an attacker can trigger it by submitting a malicious AC4 file, potentially locally or through a network service if MP4Box is invoked in that context. Based on the description, it is inferred that the attacker would need to deliver a malicious AC4 file to the MP4Box tool in order to trigger the denial of service; this could be done either locally or via a network service that processes AC4 files. No CISA KEV listing and no EPSS score are available, indicating a relatively low exploitation probability; however, environments that rely on MP4Box for media processing should prioritize patching. The CVSS score of 5.5 indicates a medium severity issue.