A heap-based buffer overflow is triggered when the sgpd_del_entry function in the MP4Box component processes specially crafted input. The flaw allows an attacker with local access to overwrite adjacent heap memory, which can corrupt program state, crash the application, or potentially lead to integrity compromise. The vulnerability is a classic instance of out-of-bounds write (CWE-119, CWE-122).

All releases of GPAC prior to the commit f29f955f2a3b5e8e507caad3e52319f961bf37bf, including version identifiers up to b40ce70f5, are affected. Any distribution or derivative containing the vulnerable MP4Box module remains at risk until the fix is applied.

The CVSS score of 4.8 indicates medium severity; EPSS <1% shows a very low probability of exploitation at this time. Nonetheless, a publicly available proof of concept exists, and the vulnerability only requires local access, making it easier for attackers who already have foothold to exploit. The issue is not listed in CISA KEV, but the existence of the PoC reduces the attacker’s effort for future use.