The vulnerability is a null pointer dereference in the smooth_parse_stream_index() function within GPAC's media parsing subsystem. When a null pointer is passed, the application crashes, terminating media processing and resulting in a denial of service that impacts the availability of any solution relying on GPAC for media handling. The weakness corresponds to CWE-476 and the CVSS score of 5.5 indicates a moderate level of severity.

Any build of GPAC that incorporates the master HEAD code before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 is vulnerable. The flaw resides in src/media_tools/mpd.c, part of the media tools component. Systems that compile GPAC from source or deploy distribution packages without applying this patch, particularly those that process untrusted media streams, are at risk.

An attacker can trigger the vulnerability by crafting a media file or stream that forces smooth_parse_stream_index() to be called with a null argument. Based on the description, the likely attack vector appears to be an untrusted media input processed by GPAC, such as a malicious video or audio file on a media server or a client application. The EPSS score is reported as less than 1%, and the vulnerability is not listed in CISA’s KEV catalogue, indicating a low exploitation probability. Nevertheless, successful exploitation causes an application crash and a denial of service for the affected service.