This vulnerability in GPAC up to version 26.02.0 is located in the ISOBMFF Parser component, specifically in src/utils/base_encoding.c. It allows a local attacker to trigger a condition involving highly compressed data that could lead to resource exhaustion or related issues during decompression. The vendor has addressed the issue by implementing a limit on the inflate output size, stopping decompression if the output exceeds 32 times the input size. The patch is identified by commit 297f2d8d1f493d8b241330533cd47f7da758aeb3. Exploit code has been publicly disclosed, but no known exploits are reported in the wild.

A local attacker with limited privileges can exploit this vulnerability to cause excessive resource consumption during decompression of highly compressed data. This may lead to denial of service or other stability issues in the affected component. There is no indication of privilege escalation, remote exploitation, or data confidentiality/integrity impact.

A patch has been committed that adds a check on the inflate output size, stopping decompression if the output size surpasses 32 times the input size. Users of GPAC version 26.02 should apply this patch (commit 297f2d8d1f493d8b241330533cd47f7da758aeb3) to remediate the vulnerability. Patch status is not explicitly confirmed as released in a vendor advisory; therefore, users should verify the availability of this fix from the official GPAC source or repository.