The vulnerability is a classic buffer overflow in the gpac library, occurring in the svgNameToImplementationName routine that converts an SVG element name to its implementation name. An attacker that can supply a specially crafted SVG input can cause memory corruption and gain the ability to execute arbitrary code on the host system. The weakness is a classic example of a buffer overflow that overflows a fixed-size buffer without bounds checking.

The affected product is the GPAC Multimedia Framework. All GPAC releases that include the vulnerable svgNameToImplementationName() function prior to the commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 are susceptible. No vendor or product list from the CNA is available, but any deployment of gpac that processes untrusted SVG content is at risk.

The CVSS score is 7.8 and the EPSS score is < 1%, indicating a low probability of exploitation but a high impact if successful. The lack of a KEV listing indicates no known public exploitation has been reported. However, the nature of the flaw—remote code execution through user‑supplied SVG—poses a high intrinsic risk. If gpac is used in a network‑facing service or embedded in user‑facing applications, an attacker could trigger the overflow remotely, leading to complete system compromise. In environments where gpac does not process external input, the likelihood of exploitation drops significantly, but the flaw remains a critical vulnerability until patched.