GPAC MP4Box EUVD-2025-211130

Exploitation requires a user to run GPAC MP4Box in its SAP-dumping code path (the dump_isom_saps routine in mp4box/filedump.c, i.e. sample-access-point dump mode) against an attacker-supplied crafted MP4 file. This is a local action requiring user interaction (UI:R): the attacker cannot trigger it remotely or without the victim invoking the tool on the malicious file. Limiting factors: no authentication is needed once the file is processed (PR:N), but the attacker must get the victim to process the file, impact is confined to crashing the MP4Box process (availability only, no code execution or data disclosure), and the vulnerable path only executes when SAP dumping is requested.

This is a genuine but low-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local, user-interaction-dependent crash with impact limited to availability - no confidentiality or integrity loss and no code execution. The source fix confirms this: the commit adds a NULL guard ('if (!samp) continue;') in dump_isom_saps, so the root cause is a NULL-pointer dereference on an unresolved sample rather than a classic memory-corruption RCE, despite the CWE-119 (buffer errors) classification and the 'Buffer Overflow' tag. Publicly available exploit code exists (github-poc referencing a crash PoC), but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation; POC availability must not be conflated with in-the-wild use. Net: a real, reproducible DoS in a parsing utility, but the local vector (AV:L) and requirement that a user run MP4Box on an attacker-supplied file (UI:R) cap real-world risk well below what a high CVSS alone would suggest. Note the signals are internally consistent - local vector plus required user interaction matches the file-parsing nature of the flaw - so no vector/description conflict exists to flag.

An attacker crafts a malformed MP4 file and delivers it to a victim (download, email, or as media fed into an automated pipeline). When the victim runs GPAC MP4Box in a SAP-dumping mode over the file, dump_isom_saps dereferences a NULL sample pointer and the process crashes with a segmentation fault. A public proof-of-concept crash file is available, but impact is limited to a one-shot denial of service of the MP4Box process.