GPAC MP4Box EUVD-2025-211133

Exploitation requires a local user to process an attacker-supplied, crafted AC4 file with GPAC/MP4Box (CVSS AV:L with UI:R) - the attacker cannot trigger it remotely or without a victim action. No special non-default configuration is named in the description; the trigger is the AC4 configuration parsing path (gf_odf_ac4_cfg_clean_list and the AC4 substream-group/presentation parsing hardened in the fix). Limiting factors that reduce real-world risk: it is local-only, needs voluntary user interaction to open/convert the malicious file, requires no authentication but no privileges are gained either, and the impact is confined to a crash (availability) with no confidentiality or integrity effect and no code execution claimed in the sources.

This is a genuinely low-to-moderate priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local, user-interaction-dependent flaw whose only impact is availability - a process crash - with no confidentiality or integrity effect, yielding a Medium 5.5 base score. EPSS reinforces this: 0.17% probability at the 6th percentile indicates exploitation in the wild is highly unlikely. There is no CISA KEV listing, so there is no evidence of active exploitation. The vuln.today decision label is 'this_month', i.e. routine patching rather than act_now/emergency, which aligns with the other signals. The GitHub issue (#3297) and the infosec.exchange post are public reports of the bug, but the input does not mark a confirmed working PoC, so these should be treated as a public bug report / PoC reference, not weaponized exploit code. Net assessment: this is a memory-safety DoS in a file parser, typical of fuzzing-driven findings - a real bug worth fixing, but not a high-real-risk emergency. No signals conflict with the Medium severity.

An attacker crafts a malicious AC4 audio file and induces a victim to process it with GPAC/MP4Box (for example by submitting it to an automated media-conversion pipeline or convincing an operator to open it locally). Parsing the malformed AC4 configuration triggers a heap use-after-free in gf_odf_ac4_cfg_clean_list, crashing the process and denying service. A public bug report exists (GitHub issue #3297 and an infosec.exchange post), but the input does not confirm working exploit code, so it should be treated as a PoC reference not verified as a working exploit.