The flaw resides in the elng_box_read routine of GPAC’s MP4Box component. Manipulating the elng argument triggers an out-of-bounds read. The bug stems from improper bounds checking (CWE-119 and CWE-125) and can lead to reading bytes beyond the intended buffer. Based on the nature of an out-of-bounds read, it is inferred that an attacker could potentially gain access to nearby memory contents, which may include sensitive information.

The vulnerability affects all GPAC releases up to and including 26.03‑DEV‑rev105‑g8f39a1eb3‑master, as these contain the unpatched elng_box_read implementation. The vendor is GPAC and the product is its GPAC multimedia framework, specifically the MP4Box utility. The fix is delivered in the commit cf6ac48c972eaaee2af270adc3f36615325deb3e, which is incorporated in the abi‑16.8 release and later.

The CVSS score is 4.8, indicating medium severity. The exploit is publicly available but requires local execution; no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. If an attacker can run code locally, they can trigger the out-of-bounds read and, based on the bug’s characteristics, infer that sensitive memory contents might be leaked, although remote exploitation is not possible.