An out-of-bounds read occurs in the gf_dm_get_chunk_data function within the GPAC download utilities. The flaw allows a malicious actor to construct a specially crafted HTTP request that triggers the read, causing the application to crash. The primary impact is a denial of service where the GPAC instance becomes unavailable.

The vulnerability affects GPAC version 26.07.0 and any deployments that use the downloader module without the patch. No specific vendor or product name is listed, but the issue is tied to the open-source GPAC media framework. Users running this version should verify they are not using the vulnerable component.

The CVSS score of 6.5 indicates a medium severity. EPSS is not available, and the issue is not listed in CISA's KEV catalog, suggesting a lower likelihood of widespread exploitation at present. Attackers could trigger the bug by sending a malicious HTTP request to the GPAC instance. No special privileges or additional conditions are mentioned, implying the exploit can be performed from an external network if the downloader is exposed.