A heap use‑after‑free flaw exists in the gf_filter_pid_send_event_downstream function of the GPAC MP4Box tool. When a specially crafted MP4 file is parsed, the program frees a memory block and subsequently attempts to use it again, causing an application crash. The weakness is typical of a use‑after‑free and may also involve heap buffer overflow characteristics (CWE‑122). The impact is limited to loss of availability; it does not lead to information disclosure or unauthorized modification of data.

GPAC Project’s MP4Box component, versions prior to 2.5, is affected. The vendor is the GPAC Project and the product is MP4Box. No explicit sub‑version range is provided beyond the pre‑2.5 release line.

The EPSS score is less than 1%, indicating a very low probability of exploitation, while the CVSS score of 5.5 denotes moderate severity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the supply of a malicious MP4 file to the vulnerable program, either locally or remotely if the MP4Box instance is exposed to untrusted input. The principal impact is application crash, which results in a denial of service without direct confidentiality or integrity compromise.