A buffer overflow in the GPAC media framework's j2kdec_process function permits attackers to execute arbitrary code on systems that process untrusted JPEG 2000 data. The overflow occurs when malformed data bypasses bounds checking, enabling the attacker to overwrite critical memory and gain full control over the process. This vulnerability directly leads to remote or local code execution depending on how the system invokes the decoder.

GPAC, the open‑source multimedia framework, is affected. The flaw exists in the code identified by commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. The security fix is applied in commit 9a253a07fd3f6b48022bba74302bf39388dda859. No vendor or version range is specified in the CVE entry, but any deployment using this version of GPAC is potentially vulnerable.

The CVSS score is 7.8 and EPSS is < 1%. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at the time of reporting. Exploitation would likely require the attacker to supply crafted JPEG 2000 data that is parsed by GPAC. Because this is a classic buffer overflow, the exploit can be processed, though techniques such as ASLR, stack canaries, and sandboxing may reduce the risk.