The vulnerability is an out-of-bounds write in the function svgin_process of GPAC's SVG Parser, as described in the vendor's advisory. This defect corresponds to CWE‑119 and CWE‑787 and can corrupt memory, potentially causing application crashes or other unintended behavior. Key detail from vendor description: "The manipulation leads to out-of-bounds write." The damage is limited to the process that processes the SVG file; it does not grant arbitrary code execution by itself but may enable denial of service or a foothold for further attacks.

Affecting the GPAC library, specifically the 26.03‑DEV release as mentioned in the advisory. No additional sub‑version details are listed beyond the commit that patches the issue. The product is identified by the CPE cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*.

The CVSS base score is 4.8, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Attack requires local access to execute a crafted SVG file in the context of GPAC. The official patch commit 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2 demonstrates that exploitation is possible but limited to privilege level of the local user.