GPAC MP4Box EUVD-2025-211166

Exploitation requires an attacker-supplied crafted AC4 file to be parsed by GPAC/MP4Box before version 2.5; the flaw is in the AC4 configuration cleanup (gf_odf_ac4_cfg_clean_list / AC4 parsing in descriptors.c and av_parsers.c). Per the CVSS vector it is local (AV:L) and requires user interaction (UI:R), meaning the victim or an automated workflow must open/process the malicious file - there is no remote, interaction-free path. No special non-default configuration is called out in the sources; the limiting factors are the need to deliver the file and have it parsed, and the impact is confined to availability (crash/DoS), with no code execution, data disclosure, or integrity impact indicated by the evidence.

This is a moderate-severity, low-priority memory-safety bug rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) scopes the issue to local exploitation requiring user interaction, with impact limited to availability (no confidentiality or integrity loss) - i.e., a crash/DoS of the MP4Box/GPAC process when it parses a malicious file. The signals are consistent and point to low real-world risk: EPSS is 0.18% (7th percentile), the CVE is NOT on CISA KEV (no confirmed active exploitation), and the vuln.today decision label is 'this_month' (routine patching, not act_now/emergency). A public PoC reference exists (sigdevel pocs repo and infosec.exchange post) but it is not verified as working exploit code, so this should not be conflated with active exploitation. The CWE-416 use-after-free is confirmed by the vendor commit, but because impact is A:H only against a file-parsing utility, this is a high-CVSS-for-its-class availability bug, not a priority intrusion vector. Note: the CPE string (cpe:2.3:a:n/a:n/a) and EUVD affected version ('n/a n/a') are placeholder/unpopulated; the actual affected scope is GPAC/MP4Box before 2.5 per the description and the fixing commit.

An attacker crafts a malformed AC4 audio file and gets a victim to open or process it with MP4Box/GPAC (e.g., via an automated media-ingestion pipeline or a user manually inspecting an untrusted file). Parsing the crafted AC4 data triggers a heap use-after-free in the AC4 configuration cleanup path, crashing the application and denying service. A public PoC reference exists but is not verified as working exploit code; exploitation is local and requires the victim to parse the file (UI:R).