The vulnerability resides in the txtin_process_texml function of the TeXML File Parser component within GPAC. A specially crafted TeXML file can cause the function to write beyond the bounds of a local stack buffer, resulting in a stack-based buffer overflow. This flaw is identified as CWE‑119 (Buffer Over-read) and CWE‑121 (Stack-based Buffer Overflow) and may lead to a crash or execution of attacker-supplied code if local privileges are obtained.

GPAC multimedia framework, version 26.03-DEV, the development snapshot referenced in the CVE. The CPE string cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:* indicates that all variants of GPAC with the same unpatched code are affected. No specific release numbers beyond 26.03-DEV are listed, but any build incorporating the unpatched function is vulnerable.

The CVSS score of 4.8 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the flaw locally by providing a malicious TeXML file to the GPAC parser; there is no documented network exposure. A public exploit script is available, confirming that local exploitation is feasible and could be leveraged in attacks that rely on GPAC processing of untrusted documents.