A segmentation fault occurs in the gf_props_equal_internal function of GPAC MP4Box prior to version 2.5 when handling a crafted data file. The fault is triggered during a property comparison operation, causing the process to crash and denying service to legitimate users. This vulnerability does not leak sensitive data or grant remote code execution, but it can be used to disrupt operations by forcing the application to terminate unexpectedly.

The issue affects the GPAC Project packaging tool MP4Box before version 2.5, which is commonly used to package, demultiplex, and edit MP4 files. The specific product name is GPAC MP4Box; no additional vendor or product naming is provided in the advisory.

Although the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the possibility of an attacker creating a malicious media file that triggers the fault means that the likelihood of exploitation remains non-zero. The CVSS base score is 5.5, but the vulnerability’s denial of service impact and lack of mitigations in the affected releases make it a moderate to high risk for environments that process untrusted media. The attack vector is inferred to be local or remote via the delivery of a crafted media file to the MP4Box tool.