The GPAC Project’s MP4Box tool contains a segmentation fault in the gf_isom_get_esd function located in /isomedia/isom_read.c. When a carefully constructed XML file is parsed, the function dereferences an invalid pointer causing the process to crash. The resulting flaw can be exploited to terminate the MP4Box instance, disrupting any services or pipelines that depend on it.

All releases of GPAC MP4Box older than version 2.5 are affected. Systems that rely on these binaries to parse or transform XML metadata from untrusted sources are exposed to a possible denial of service condition.

The CVSS score is 5.5 and the EPSS score is < 1%. The flaw is not listed in KEV. Exploitation requires an attacker to supply a crafted XML file to a running instance of MP4Box. It is inferred that if MP4Box is exposed to external input via a network service or is incorporated into a shared media‑processing pipeline, the denial of service could propagate to higher‑level applications that depend on it. The extent of impact is limited to the availability of the MP4Box process and any downstream services, with no evidence of confidentiality or integrity compromise.