The weakness resides in an unspecified section of base_encoding.c in GPAC’s ISOBMFF parser. An attacker can supply a crafted media file that causes the inflater to produce data up to 32 times larger than the input, leading to excessive memory or CPU consumption. Because the vulnerability is triggered only during local execution of the gpac binary, any user who can run gpac or supply a media stream can use this flaw to incapacitate the host. The flaw represents a resource exhaustion problem tied to improper size handling (CWE‑404 and CWE‑409).

GPAC, specifically the ISOBMFF parser component included in the gpac binary. All releases up to and including version 26.02.0 are affected. The issue has been addressed by the vendor in a patch that introduces a size check for inflated output that aborts when the size would exceed 32 times the input.

The CVSS score of 4.8 indicates moderate severity. EPSS data is not available and the exploit is not listed in CISA’s KEV catalog, but a public exploit is known. Because the attack requires only local execution, the risk is limited to users with local access to the gpac process. A breach would mainly lead to a denial‑of‑service condition rather than a full compromise. Monitoring and containment remain advised until the patch is installed.