Executive brief
A vulnerability in the GPAC MP4Box utility, a tool used for processing and packaging multimedia files, can lead to a sudden application crash. By tricking a user into processing a specially crafted MP4 file, an attacker can cause the software to stop functioning. This results in a denial of service, potentially disrupting automated media processing workflows or individual user tasks.
Technical details
A NULL pointer dereference exists in the TrackWriter handling component within filters/mux_isom.c of GPAC MP4Box v2.4. The vulnerability is triggered when the application attempts to process a maliciously crafted MP4 file that lacks expected data structures, leading to an invalid memory access. An attacker can exploit this by providing a specially designed file to be processed by the utility, resulting in an immediate crash (Denial of Service). This is a local attack vector requiring the user or an automated system to open the malicious file. No information regarding a formal patch was provided in the advisory.
Affected products
- GPAC MP4Box 2.4
Timeline
- 2026-06-15: disclosed: Initial disclosure of the vulnerability
- 2026-06-15: advisory: NVD record published