GPAC MP4Box EUVD-2025-211150

A victim must run MP4Box (GPAC before 2.5) against an attacker-supplied crafted MPEG-4 file that reaches the scene-statistics code path, where StatSFVec2f (/scene_manager/scene_stats.c) is invoked with a NULL 'val' pointer and dereferences it. Per the CVSS vector this is a LOCAL attack (AV:L) requiring user interaction (UI:R) with no privileges (PR:N) - i.e. the operator must choose to process the malicious file; there is no remote or unauthenticated network trigger. Limiting factors: impact is confined to a denial of service (crash) of the processing tool, with no confidentiality or integrity impact and no code execution indicated by the available sources; the trigger depends on the file exercising the scene-statistics path. The fix (the only remediation stated by the evidence) is upgrading to GPAC 2.5, which adds the '!val' NULL check.

This is a medium-severity local denial-of-service issue, not a high-priority emergency. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scores 5.5 and describes a local attack requiring user interaction, with impact limited to availability (A:H) and no confidentiality or integrity effect - consistent with the NULL pointer dereference (CWE-476) crashing the MP4Box process. The decision signals reinforce low urgency: EPSS is 0.16% (5th percentile), the CVE is NOT in CISA KEV (no confirmed active exploitation), and the vuln.today priority is 'this_month' rather than act_now/emergency. A public PoC reference exists (sigdevel/pocs and an infosec.exchange post) but it is not verified as working exploit code, so PoC availability must not be read as active exploitation. The only mild tension is that the DoS impact is rated A:H while the real-world effect is a crash of a file-processing tool rather than a persistent service outage; this is reasonable but worth noting when prioritizing. The commit (75786eb) confirms the mechanism and the fix (adding a '!val' guard in StatSFVec2f/StatSVGPoint/StatFixed). Net: a genuine but low-real-risk bug suited to routine patch cycles.

An attacker crafts a malicious MPEG-4 file and gets a victim to process it with MP4Box (before version 2.5), for example via a conversion or scene-statistics workflow. During scene statistics processing, StatSFVec2f is called with a NULL 'val' pointer and dereferences it, crashing the process and causing a denial of service. A public PoC reference exists but is not verified as working exploit code; exploitation is local and requires the victim to act on the file (UI:R).