A segmentation violation occurs in the gf_isom_apple_set_tag_ex function within isom_write.c of the GPAC Project’s MP4Box utility. The defect results from a NULL Pointer Dereference (CWE‑476), causing an unhandled crash when the tool processes a specially crafted MP4 file. The crash destroys the running instance of MP4Box, thereby denying service to any workflow that relies on the binary.

Any deployment that uses GPAC Project’s MP4Box prior to version 26.02.0 may be impacted. Common environments include media servers, content creation pipelines, embedded media players, and automated video processing services that invoke MP4Box on user-supplied files.

The CVSS score of 5.5 indicates moderate severity; the flaw can be triggered by feeding a crafted MP4 file to MP4Box, either locally or via a network interface that delivers such files. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower probability of mass exploitation. Nevertheless, an attacker who can supply non‑validated MP4 input can cause the application to crash, resulting in a denial of service until the service is manually or automatically restarted.