Systems using GPAC's MP4Box to import MPEG-2 Transport Stream content are exposed when they process a crafted input. The issue was reproduced in GPAC 2.5-DEV-rev1665-g3f20eb0cd-master at commit 3f20eb0cd22116367c036e6ffe6ace299b38d686.
An attacker needs to provide a crafted MPEG-2 Transport Stream that is imported by MP4Box. The supplied CVSS vector includes user interaction, consistent with requiring someone or a processing workflow to handle the malicious input.
The reported behavior is an MP4Box termination caused by reading from a freed PID instance, resulting in denial of service. The report also states that attacker-influenced replacement of the stale heap object means arbitrary code execution cannot be ruled out.
Compare the GPAC source revision with the reported fixed commit, d0793f92e04fe284a25c2a9335cc5edc68deb6d4. The report identifies commit 3f20eb0cd22116367c036e6ffe6ace299b38d686 as a version in which the issue was reproduced.