The vulnerability is a NULL pointer dereference in the dasher_insert_timeline_entry function within the dasher.c filter of GPAC MP4Box. Supplying a crafted MP4 file triggers the flaw, causing the application to crash. The primary impact is a denial of service; there is no elevation of privilege or data exfiltration specified. The weakness corresponds to improper handling of null pointers, a common source of stability problems.

The affected software is GPAC Project/MP4Box, specifically builds earlier than version 2.5. The issue resides in the dasher.c filter that processes MP4 timeline entries. No vendor specific product list is available beyond the GPAC project name and the mentioned file paths. Users running older versions should inventory installations of MP4Box to assess exposure.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation activity to date. The public description states that a crafted MP4 file can trigger a crash, resulting in a denial of service. The flaw exists in the dasher_insert_timeline_entry function used by MP4Box when processing MP4 media. The CVSS score of 5.5 indicates moderate severity.