The vulnerability is a null pointer dereference in the dump_isom_rtp function of GPAC's filedump module. By manipulating specific input data, a local attacker can trigger the dereference, causing the application to crash. The crash may lead to denial of service for processes that rely on GPAC’s filedump functionality. The weakness is identified as CWE‑476 and CWE‑404, indicating that internal control flow handling and error checking are insufficient.

GPAC, the media processing and streaming framework, is affected in all releases to and including version 2.4.0. Users running GPAC 2.4.0 or any prior release should verify whether the identified vulnerability exists in their binary and plan an upgrade accordingly.

The CVSS v3.1 score is 4.8, reflecting a moderate severity due to local exploitation requirements. The EPSS score is below 1%, suggesting a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. However, because the flaw requires only local access, it can be abused by privileged users or through local privilege escalation to cause service disruption. The only known fix is a patch that resolves the null dereference and is recommended for all vulnerable versions.