An attacker needs to persuade someone or an automated workflow to import an attacker-controlled MP4 file with MP4Box. The CVSS vector indicates local attack access and required user interaction, with no privileges required.
Processing the malformed input causes MP4Box to crash, resulting in a denial of service. Arbitrary code execution was not demonstrated.
The issue was reproduced in GPAC 2.5-DEV-rev1699-g31becc9e0-master at commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9. The supplied data identifies commit fcb9083292befe61d3e2466b18edfedba49da098 as the fix.
Do not import untrusted MP4 files with MP4Box, particularly files that may contain malformed or truncated ODF descriptors or box structures. Restricting MP4Box processing to trusted inputs reduces exposure to the crash.