GPAC MP4Box EUVD-2025-211158

Exploitation requires a victim to process an attacker-supplied crafted MPEG-2 file using a vulnerable GPAC/MP4Box build (before 2.5); the CVSS vector's AV:L and UI:R confirm local access and required user interaction, so there is no remote or autonomous trigger - someone must invoke MP4Box/GPAC on the malicious input. Impact is limited to a process crash (A:H, with C:N/I:N), not data exposure or code execution per the available data. Limiting factors: the attacker cannot act without the victim choosing to parse the file, and the issue is remediated by upgrading to GPAC 2.5 (the upstream fix adds an nb_shared_packets_out check in the filter task-removal path); updating is the remediation indicated by the evidence.

Signals converge on a moderate, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, user-interaction-dependent flaw whose only impact is availability - a crash of the MP4Box/GPAC process with no confidentiality or integrity loss and no scope change, consistent with the description's Denial-of-Service characterization and CWE-416 (use-after-free). EPSS is low at 0.17% (6th percentile), the CVE is NOT listed in CISA KEV, and the PoC is a reference only, not verified as working exploit code - so there is no evidence of active exploitation, only a public PoC reference. The vuln.today decision label is 'this_month', not act_now or emergency, matching the low exploitation signals. A CWE-416 use-after-free can sometimes be escalated beyond a crash, but MITRE/NVD scope the impact strictly to DoS (A:H only), and no source evidence suggests code execution; treating this as availability-only is the defensible reading. Note a minor location discrepancy: the description places the flaw in gf_filter_packet_destroy within /filter_core/filter_pck.c, while the supplied fix commit (c592a14) modifies gf_filter_remove_task in filter_core/filter.c by adding an nb_shared_packets_out guard - related shared-packet lifecycle handling, but the exact trigger path is not fully reconciled in the available sources. Overall this is a genuine but low-priority bug: real enough to patch on a normal cycle, not an emergency.

An attacker crafts a malicious MPEG-2 file and gets a victim to process it with a vulnerable MP4Box/GPAC build (before 2.5), for example in a media-conversion or ingest workflow. Parsing the file triggers a use-after-free during filter packet teardown, crashing the process and causing denial of service. A public PoC reference exists (sigdevel/pocs), but it is not verified as working exploit code, and exploitation requires local processing of the file plus user interaction.