The vulnerability resides in the sidx_box_read function of GPAC’s isomedia/box_code_base.c. Manipulation of the sidx box leads to unbounded resource allocation, which can exhaust memory or other system resources and cause the application to crash or become unresponsive. The weakness is a classic resource‑exhaustion flaw and is classified as CWE‑400 and CWE‑770.

All releases of GPAC up to and including version 26.02.0 are affected. No higher‑numbered releases were mentioned as vulnerable. The affected product is GPAC, which is an open‑source multimedia framework used for packaging and processing media streams.

With a CVSS score of 4.8, the severity is moderate, though the lack of a remote attack vector means an attacker must compromise the local host or submit a malicious media file to a compromised GPAC instance to exercise the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The publicly disclosed exploit, referenced by commit 442e2299530138d8f874fd885c565ba98a6318ba, demonstrates that attackers can trigger the out‑of‑memory conditions when parsing crafted media. Consequently, the risk to any system that processes local media files is elevated, especially in environments where GPAC is exposed to untrusted input.