GPAC MP4Box EUVD-2025-211139

Exploitation requires a victim to locally process an attacker-supplied crafted data file with a vulnerable GPAC/MP4Box build prior to version 2.5; the crash occurs in gf_props_equal_internal (filter_core/filter_props.c), and the related upstream fix rejects const data passed as a user-assigned PID property. Limiting factors: the vector is local (AV:L) and requires user interaction (UI:R) - the victim must actually run MP4Box against the malicious file; there is no remote or network-facing trigger and no authentication bypass. Impact is confined to denial of service (process crash per A:H, C:N/I:N); there is no code execution or data disclosure in the available data. The precise malformed-file structure that triggers the out-of-bounds read is not detailed in the available sources beyond the crafted-file requirement.

This is a moderate, low-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a LOCAL vulnerability requiring user interaction, with the sole impact being availability (a crash/segmentation violation) - no confidentiality or integrity impact per the vector. EPSS is low at 0.20% (9th percentile), consistent with a local file-parsing DoS that is unlikely to be mass-exploited. The CVE is NOT on CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (github-poc and the sigdevel infosec.exchange post) but the input marks it 'reference only, not verified as working exploit code', so it should not be treated as a confirmed weaponized exploit. The vuln.today decision label is 'this_month', indicating routine prioritization, not urgent action. Note a conflict worth flagging: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N - the available data does not support an information-disclosure outcome, only denial of service; the tag appears to be a generic class label rather than a confirmed impact. Overall this is a genuine but low-severity, locally-triggered crash in a file-processing tool, not a high-urgency remote threat.

An attacker crafts a malformed media/data file and distributes it to a victim (e.g., via download, email, or a shared asset in a media pipeline). When the victim processes the file with a vulnerable MP4Box/GPAC build (before 2.5), an out-of-bounds read in gf_props_equal_internal triggers a segmentation violation, crashing the process. A public PoC reference exists but is not verified as working exploit code; impact is limited to denial of service (process crash), with no code execution or data disclosure indicated by the CVSS vector.