The vulnerability resides in the Media_GetSample function within GPAC’s MP4Box component. Improper handling of the cat argument triggers a memory leak, leading to gradual loss of available memory. While the leak does not directly grant code execution or compromise confidentiality, repeated exploitation can degrade system performance or cause service disruptions when memory resources are exhausted.

GPAC, version 2.4.0 and earlier, specifically the MP4Box tool. The issue is contained within the media.c source file and affects all builds that include this component. No specific sub‑component or operating system variant is singled out.

The CVSS score of 4.8 indicates moderate severity. Exploitation requires local access to the target system; there is no known remote attack vector. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate likelihood of widespread exploitation. However, repeated local attacks could still deplete memory over time, potentially affecting availability of the host or co‑executing processes.