This vulnerability involves a use-after-free condition in the gf_filter_pid_reconfigure_task_discard function located in /filter_core/filter_pid.c of GPAC Project/MP4Box. Versions prior to 26.02.0 are affected. An attacker can exploit this by providing a crafted media file, leading to a denial of service. The CVSS vector indicates the attack requires local access with low complexity and no privileges, and user interaction is required. The impact is limited to availability with no confidentiality or integrity impact. No known exploits are reported in the wild, and no official remediation level or patch is currently documented.

Successful exploitation results in denial of service, causing the affected application to crash or become unresponsive. There is no impact on confidentiality or integrity. The attack requires local access and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted or suspicious media files with affected versions of GPAC Project/MP4Box. Monitor vendor channels for updates regarding patches or mitigations.