A stack‑based buffer overflow exists in the GPAC MP4Box component within the function swf_def_bits_jpeg located in src/scene_manager/swf_parse.c. The overflow is triggered by malicious manipulation of the szName argument supplied when parsing a SWF file, allowing corruption of the call stack. If successfully exploited, the flaw can lead to remote code execution or a denial‑of‑service condition, and the CVE description confirms that the attack can be launched remotely and that a proof‑of‑concept exploit is publicly available. The weakness falls under the CWE categories 119 and 121.

The vulnerability affects GPAC versions up to and including 2.5-DEV-rev2167-gcc9d617c0-master. All releases prior to the commit 8961c74f87ae3fe2d3352e622f7730ca96d50cf1 contain the flaw. The affected product is listed in the CPE string cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*, and any deployment that processes SWF files with MP4Box is potentially impacted.

The CVSS base score of 5.3 indicates a medium severity, but the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to feed a crafted SWF file to the vulnerable parser, which can be performed remotely via any interface that accepts SWF input. Attackers who succeed can execute arbitrary code or cause a crash, but the low EPSS indicates that active attacks are currently rare. Awareness of this flaw and monitoring for exploit activity remains advisable.