A stack buffer overflow occurs while parsing NHML files in GPAC’s demuxer. The xmlHeaderEnd attribute is copied without length checks into a 1000‑byte buffer. If an attacker supplies more than 1000 bytes, the copy overruns the stack, potentially corrupting memory and enabling arbitrary code execution within the GPAC process. The vulnerability is characterized as CWE‑121 and presents a functional flaw that can compromise the stability, confidentiality and integrity of the application.

GPAC (gpac:gpac) versions up to and including 26.02.0 are affected. Users relying on the GPAC multimedia framework in any environment that processes NHML files should verify the installed version.

The CVSS score of 7.7 indicates a high severity due to likely remote exploitation through crafted input. The EPSS score of less than 1% shows that, as of the data provided, exploitation is not frequently observed, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to provide a malicious NHML file—either locally or through any network service that invokes GPAC’s demuxer—an inference drawn from the description. With no monitoring or active exploitation data, the risk remains high until remediated.