This vulnerability involves a null pointer dereference in the MergeFragment function of the MP4Box component in GPAC versions 2.0 through 2.4.0. The flaw occurs in the file src/isomedia/isom_intern.c and can be triggered locally by an attacker with low privileges. The CVSS 4.0 base score is 4.8, reflecting medium severity with local attack vector, low complexity, and no user interaction required. A patch commit (525bf1af642c30af04e4df5345e6d798c0a4d8a1) has been identified to address the issue, though no official vendor advisory or remediation level is available.

Successful exploitation results in a null pointer dereference, which can cause the affected application to crash or become unavailable. The attack requires local access and low privileges, limiting the scope of impact. There is no indication of remote exploitation or privilege escalation. No known exploits are reported in the wild at this time.

A patch has been identified for this vulnerability (commit 525bf1af642c30af04e4df5345e6d798c0a4d8a1). It is advisable to apply this patch to affected GPAC versions (2.0 through 2.4.0) to remediate the issue. Since no official vendor advisory or remediation level is provided, users should monitor the GPAC project for official updates and apply the patch promptly. No alternative mitigations or workarounds are documented.