A critical vulnerability exists in the GPAC multimedia framework's SRT subtitle import routine, specifically the gf_text_import_srt_bifs function in src/scene_manager/text_to_bifs.c. The bug facilitates an out‑of‑bounds write due to improper bounds checking during subtitle data conversion, classified as CWE‑119 and CWE‑787. An attacker with local access can supply a crafted SRT file that triggers the memory corruption, potentially allowing arbitrary code execution or privilege escalation on the host system. The impact is limited to systems running an affected GPAC build and requiring local file manipulation.

GPAC, versions up to and including 2.4.0 of the GPAC multimedia framework, including any applications that embed GPAC’s subtitle processing component. The issue is tied to the SRT subtitle import feature of the core GPAC library. System administrators should be aware that any binaries compiled against these releases are vulnerable.

According to the CVSS scoring, this flaw scores 4.8, indicating moderate severity. The EPSS value is below 1 %, suggesting a low likelihood of widespread exploitation as of the last assessment. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local access to the GPAC installation and the ability to trigger subtitle import with a malicious SRT file. No remote attack vector is documented, so the risk is confined to environments where untrusted SRT input can be processed by a local instance of GPAC.