This vulnerability is a NULL pointer dereference in the gf_filter_in_parent_chain function located in /filter_core/filter_pid.c of GPAC Project/MP4Box versions prior to 26.02.0. An attacker can cause a denial of service by providing a specially crafted file that triggers the NULL pointer dereference. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or integrity impact, and high impact on availability. There is no known exploit in the wild and no vendor advisory or patch information is currently available.

Successful exploitation causes a denial of service by crashing the application due to a NULL pointer dereference. There is no impact on confidentiality or integrity. The attack requires local access and user interaction to trigger the vulnerability via a crafted file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or suspicious files with affected versions of GPAC Project/MP4Box.