The vulnerability is a stack overflow in the gf_bifs_dec_node function of the GPAC MP4Box media-processing tool. When the utility parses a specially crafted MP4 file, the overflow corrupts critical stack memory, causing the process to terminate. The resulting crash manifests as a denial of service; no code execution or privilege escalation is described in the official information.

All released versions of GPAC MP4Box older than 2.5 are affected. The flaw resides in the core decoding routine, so the impact applies to any system running an affected build of MP4Box, regardless of operating system. No specific vendor or product name is listed, but the entire GPAC Project’s MP4Box tool is vulnerable.

The CVSS score of 5.5 indicates moderate severity. The flaw can be triggered simply by supplying a malicious MP4 file to the utility, so the likely attack vector is the local user or a compromised application that feeds media to MP4Box. Because the vulnerability leads to a crash rather than arbitrary code execution, the immediate risk is to availability. The EPSS score is not available for this vulnerability, and it is not reported in the CISA KEV catalog. Nonetheless, systems that rely on MP4Box in production workloads should consider a timely fix or mitigation to avoid potential downtime.