The vulnerability is a segmentation fault caused by a null pointer dereference in the gf_media_get_color_info function located in /media_tools/isom_tools.c of GPAC Project’s MP4Box before the 26.02.0 release. The flaw is triggered by a crafted media file, which forces MP4Box to crash during media processing. This results in an interruption of the application’s operation and may affect any higher‑level services or workflows that depend on MP4Box to handle media data. The weakness is a classic null dereference flaw, identified as CWE‑476.

MP4Box versions prior to 26.02.0 are impacted. All users that run any older releases of the GPAC Project’s MP4Box tool are vulnerable, regardless of additional configuration or deployment environment. The problem is specific to the MP4Box component of the GPAC project; other GPAC tools are unaffected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available, meaning there is no current data on exploitation likelihood. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker can supply a malicious media file to a system that processes untrusted input with MP4Box. The exploit does not require privileged access and relies on delivering a crafted file to the target application. Organizations running vulnerable versions should consider the risk relatively high due to the potential for service disruption.