An out‑of‑bounds read occurs in the gf_odf_ac4_cfg_dsi_v1 function within the odf/descriptors.c module of the GPAC Project’s MP4Box utility. When the utility parses an AC4 audio file that contains maliciously constructed descriptor data, the code reads beyond the bounds of the supplied buffer, potentially causing the process to crash or hang, which results in a denial of service.

All releases of GPAC Project MP4Box older than version 26.07.0 are affected. The project is hosted on GitHub under the GPAC organization, and no official vendor name is listed. Users who run the MP4Box command‑line tool or embed it in media pipelines on any operating system may be impacted.

The CVSS score is 5.5 and the EPSS score is < 1%, so the exploitation probability is low. The flaw is triggered by processing a specially crafted AC4 file, implying a local file ingestion or remote upload vector in services that use MP4Box. No public exploit is known and the vulnerability is not listed in the CISA KEV catalog, but the undefined out‑of‑bounds read could allow an attacker to crash the utility and cause a denial of service to the affected process or system.