GPAC MP4Box EUVD-2025-211160

Exploitation requires a local attack vector (AV:L) and user interaction (UI:R): a victim must process an attacker-supplied crafted file with MP4Box (per the description, a crafted XML file; the code path implicated is ISO/MP4 parsing in gf_isom_get_esd). No authentication is required to craft the input (PR:N), but there is no network vector - the attacker must get the malicious file onto the system and have it opened/processed, e.g. a user manually running MP4Box or an automated media pipeline ingesting untrusted files. Limiting factors: impact is confined to a crash of the MP4Box process (C:N/I:N, A:H, scope unchanged), so there is no code execution or data exposure, and reachability depends on MP4Box being used to parse untrusted input. The complete fix is upgrading to GPAC 2.5 (commit e6d01820); no separate mitigation is stated in the sources.

This is a low-to-moderate priority issue whose signals are consistent and point away from urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 Medium) describes a local, user-interaction-dependent flaw with no confidentiality or integrity impact - only availability (a process crash). EPSS reinforces this: 0.17% probability at the 6th percentile indicates very low expected exploitation activity. The vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. A public PoC reference exists (sigdevel/pocs and an infosec.exchange post), but it is not verified as working exploit code, so POC availability must not be conflated with real-world attacks. The vuln.today decision label is 'this_month', i.e. routine scheduled patching rather than emergency. One data tension worth flagging to defenders: the description says the crash is triggered 'via a crafted XML file', yet the named vulnerable function gf_isom_get_esd lives in /isomedia/isom_read.c (ISO base media / MP4 parsing), and the upstream fix adds a gf_isom_has_movie() guard - so the exact input format and trigger path are not cleanly reconciled in the available sources and should be verified against the GitHub issue (#3320). Net: a genuine but limited NULL-pointer DoS in a file-processing tool, not a high-real-risk remote issue despite a Medium CVSS.

An attacker crafts a malformed media/XML input and gets it processed by a victim's MP4Box instance - for example in an automated transcoding/DASH-packaging pipeline or by convincing a user to run MP4Box on the file. Parsing reaches gf_isom_get_esd with unexpected state, dereferences a NULL pointer, and the MP4Box process crashes (segmentation fault). A public PoC reference exists but is not verified as working exploit code; impact is limited to a denial of service of the affected process.