A buffer overflow in the GPAC library allows an attacker to gain arbitrary code execution by supplying a crafted file that triggers the nhntdmx_process() function. The flaw can be exploited when GPAC processes input data containing an out‑of‑bounds write, potentially enabling the attacker to execute code with the privileges of the host process. This flaw directly jeopardizes confidentiality, integrity, and availability of affected systems.

GPAC library versions released before commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 are vulnerable. No specific version numbers were published, but any build that includes the pre‑commit code path for nhntdmx_process() is at risk.

The vulnerability is a classic buffer overflow (CWE‑120) that is exploitable during media file parsing. Because the function processes external input, the attack vector is likely remote via a crafted media file or similar data stream. The CVSS score of 8.4 indicates a high severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the potential for arbitrary code execution warrants immediate attention. The vulnerability remains unpatched in deployed binaries until the fix of commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 is applied.