The vulnerability is a NULL pointer dereference in the dasher_insert_timeline_entry function within the dasher.c filter of GPAC MP4Box. Supplying a crafted MP4 file acquires the flaw, causing the application to crash. The primary impact is a denial of service; no elevation of privilege or data exfiltration is described. The weakness corresponds to improper handling of null pointers, a common source of stability problems.

The affected software is GPAC Project/MP4Box, specifically builds earlier than version 2.5. The issue resides in the dasher.c filter that processes MP4 timeline entries. No vendor specific product list is available beyond the GPAC project name and the mentioned file paths. Users running older versions should inventory installations of MP4Box to assess exposure.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation activity to date. The public description states that a crafted MP4 file can trigger a crash, resulting in a denial of service. The flaw exists in the dasher_insert_timeline_entry function used by MP4Box when processing MP4 media. The availability of the exploit depends on whether MP4Box processes untrusted media locally or within a service context. No CVSS score is assigned, so the formal severity remains undetermined.