A segmentation violation occurs in the gf_media_get_color_info function of GPAC Project/MP4Box before 26.02.0. The vulnerability is triggered by a crafted media file, resulting in a NULL pointer dereference. When exploited, the function causes the application to crash, interrupting media processing and potentially affecting higher‑level services that depend on MP4Box. The weakness is a classic null dereference flaw (CWE-476).

The vulnerability affects the GPAC Project’s MP4Box tool in all releases prior to 26.02.0. Users running MP4Box versions older than 26.02.0 are impacted regardless of additional configuration or deployment environment.

No CVSS score is publicly available, but the denial‑of‑service impact is significant. EPSS data is not published, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can supply a malicious media file to a system that processes untrusted input with MP4Box. The exploit does not require privileged access; it merely needs the ability to deliver a crafted file to the target application. Organizations running vulnerable versions should consider the risk high due to the potential for service disruption.