mp4v2 2.0.0 contains a NULL pointer dereference in MP4File::GenerateTracks() within src/mp4file.cpp. When a specially crafted MP4 file is parsed, the function dereferences a null pointer, causing the host process to crash. This flaw allows a remote attacker to truncate service availability by supplying malformed media files.

Any application that links against mp4v2 2.0.0—such as media players, video transcoders, streaming servers, or other tools that parse or generate MP4 data—is impacted. The library is open source and used in a range of projects, so the exposure extends to any derived binaries or systems embedding the vulnerable version.

The CVSS score of 7.5 signals high severity, while the EPSS score of less than 1% indicates a currently low probability of widespread exploitation, though the vulnerability is still present. The issue is not listed in CISA KEV. An attacker can trigger the denial of service by delivering a malicious MP4 file over the network or through local channels. Because the flaw is remote and does not require authentication, it poses a significant risk to availability in production environments.