A vulnerability exists in GPAC versions up to 2.4.0 within the DumpMovieInfo function of applications/mp4box/filedump.c. The flaw causes a null pointer dereference when the function processes certain input, which can lead to a crash of the GPAC process. This type of error does not provide an attacker with code execution or privilege escalation capabilities, but it can result in a denial of service by terminating the application.

The affected vendor is GPAC, and the issue affects all up to and including 2.4.0. No other versions are presently identified as vulnerable. Users running these versions on any operating system are potentially impacted, as the vulnerability is triggered by local input to the DumpMovieInfo function.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score is less than 1%, suggesting that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available, but the attack vector is local, meaning that an attacker must have the ability to run code on the affected system or provide malicious input directly. Given the public release of the exploit, the risk to systems that run GPAC in an exposed or privileged context remains a moderate concern.