A heap use-after-free in the gfodfac4cfgcleanlist function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
Systems that process AC4 files with affected GPAC MP4Box versions before 2.5 are exposed, particularly where untrusted or externally supplied media files are handled.
An attacker needs to supply a crafted AC4 file to an affected MP4Box instance. The documented impact is denial of service through a heap use-after-free condition.
Check whether MP4Box is part of your media-processing workflow and whether its GPAC version is earlier than 2.5. Review inputs and job failures involving AC4 files for crashes or service interruption.
Avoid processing untrusted AC4 files with the affected MP4Box installation. Restrict AC4 ingestion to trusted sources until the software can be updated.