GPAC MP4Box EUVD-2025-211162

Exploitation requires that MP4Box (the GPAC command-line tool, versions before 2.5) parse an attacker-supplied MP4 file whose elementary stream descriptor lacks a decoderConfig; check_media_profile then dereferences the NULL esd->decoderConfig and the process crashes. The limiting factors are significant: the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - a user or an automated workflow must actually run MP4Box against the malicious file, so this is not autonomous remote exploitation. Impact is confined to availability (process crash); there is no code execution, data disclosure, or integrity impact indicated by the description, CWE-476, or the vector. Deployments that never process untrusted MP4 files with MP4Box are not realistically exposed.

This is a medium-severity, local denial-of-service issue and the signals are consistent in pointing to low real-world urgency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) describes a local, low-complexity flaw that requires user interaction and only impacts availability - there is no confidentiality or integrity loss, and the only outcome is a crash of the MP4Box process. EPSS is very low at 0.21% (10th percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_month' rather than act_now or emergency, which aligns with routine patching urgency. The input provides a PoC reference (github-poc and infosec.exchange posts) but it is explicitly 'not verified as working exploit code', so a public PoC reference exists but is not confirmed as a functional exploit. No SSVC decision tree (exploitation/automatable/technical-impact) is supplied in the input. Net assessment: a legitimate but low-priority crash bug, not a high-CVSS-but-overrated remote threat - the only impact is process termination when a victim processes a crafted file. Note the apparent tension between PR:N (no privileges) and UI:R (user must process the attacker's file): exploitation is unauthenticated in the sense that no login is needed, but it is not autonomous - it depends on someone feeding a malicious MP4 to MP4Box.

An attacker crafts a malformed MP4 file and delivers it to a victim or an automated pipeline that uses MP4Box to inspect or process media. When MP4Box runs check_media_profile on the file, an elementary stream descriptor with a missing decoderConfig triggers a NULL pointer dereference, crashing the process (segmentation fault). A public PoC reference exists but is not verified as working exploit code.