The flaw lies in GPAC’s TeXML File Handler where the function txtin_probe_duration processes an argument named txml_timescale. When this value is manipulated to be zero, the code performs a division by zero, causing the program to crash. The crash disables GPAC during the handling of a TeXML file, leading to a service interruption for the user or application that invoked the handler. This failure corresponds to CWE‑369 and reflects improper error handling as described in CWE‑404.

Only the GPAC build 26.03‑DEV‑rev342‑g80071f700-master is known to be affected; no other vendors or product lines are listed.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation. Because the description states that an attack has to be approached locally, a local attacker must be able to supply a crafted TeXML file with a zero txml_timescale to trigger the divide‑by‑zero error. The vulnerability is not listed in CISA’s KEV catalog.