A heap‑based buffer overflow occurs in the GPAC MP4Box utility when it parses an NHML file containing malicious <BS> elements. The flaw stems from the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c, where an out‑of‑bounds write can corrupt memory on the heap. The CVE description does not assert arbitrary code execution; it indicates that such corruption could result in memory corruption or a process crash.

GPAC is the affected vendor and MP4Box is the relevant component. All releases of GPAC prior to the inclusion of commit 86b0e36e are vulnerable. Users who have not incorporated this commit, regardless of source, remain exposed.

The CVSS score of 5.8 reflects moderate severity, and an EPSS score of less than 1 % implies a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to supply a specially crafted NHML file to a running MP4Box instance, triggering the overflow during parsing.