A NULL dereference in GPAC MP4Box occurs when the parser encounters a malformed or truncated MP4 file that contains an unknown or invalid stsd entry. The parser attempts to read descriptor fields such as codec, mime, or profile strings that are missing, and a NULL pointer is passed to strlen(), causing a segmentation fault and termination of the application. The weakness is a null‑pointer dereference (CWE‑476). This results in a denial of service for any process or user that attempts to open the file, but does not provide an attacker with arbitrary code execution.

GPAC MP4Box – any installation lacking the patch that handles missing descriptor fields correctly. No specific vendor or product versions are listed, so any unpatched or older release may be susceptible.

The CVSS score of 4.3 indicates low severity, and the EPSS score is < 1 %, so the probability of exploitation is very low. It is not listed in the CISA KEV catalog. An attacker would need to supply a crafted MP4 file, which could be delivered via upload, email attachment, or shared media. The impact is limited to crashing the application; no escalation beyond denial of service is documented. The trigger requires a specially formatted file, so exploitation requires file delivery to a target system that processes the MP4 file with MP4Box.