The vulnerability is a heap use‑after‑free in the dasher_process function of GPAC Project’s MP4Box, present in all releases prior to version 26.02.0. A crafted MPEG‑2 file can trigger a read or write to freed memory, causing MP4Box to crash and stop processing input streams, thus leading to a denial‑of‑service situation. This flaw is classified as CWE‑416.

GPAC Project MP4Box versions before 26.02.0, including all minor releases up to that date, are affected. Users of the open‑source MP4Box tool should verify they are running a version not earlier than 26.02.0. No specific cnas or vendors are listed for this vulnerability, but the product name is 'GPAC Project MP4Box'.

The CVSS score is not publicly available, and the EPSS score is not disclosed, so precise quantitative risk is unknown. The vulnerability requires the ability to provide a malicious MPEG‑2 file to MP4Box, implying a local or file‑based attack vector; remote exploitation is not indicated. Because the impact is a crash rather than data disclosure or code execution, the threat is primarily to availability rather than confidentiality or integrity. The lack of listing in CISA's KEV catalog suggests that widespread exploitation has not yet been reported.