This vulnerability involves a use-after-free condition in the gf_filter_pid_get_packet function located in /filter_core/filter_pid.c within GPAC Project/MP4Box versions prior to 26.02.0. Exploitation requires supplying a crafted media file, which can trigger a Denial of Service by causing the application to access freed memory. The CVSS 3.1 vector indicates the attack requires local access with low privileges and user interaction, with no impact on confidentiality or integrity but high impact on availability.

Successful exploitation results in a Denial of Service (DoS), causing the affected application to crash or become unresponsive. There is no indication of confidentiality or integrity compromise. The attack requires local access and user interaction, limiting remote exploitation potential.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious media files with vulnerable versions of GPAC Project/MP4Box. Monitor vendor channels for updates regarding an official patch or mitigation.