This vulnerability involves a buffer overflow in GPAC's SVG attribute parsing code, specifically in the functions svg_parse_strings() and gf_svg_parse_attribute() within src/scenegraph/svg_attributes.c. An attacker with local access and user interaction can trigger this flaw to cause a denial of service by crashing the application. The CVSS 3.1 base score is 5.5, reflecting a medium severity with low attack complexity and no privileges required but user interaction needed. There is no confirmed patch or vendor advisory available as of the published date.

The impact is limited to denial of service (availability) due to a buffer overflow condition. There is no impact on confidentiality or integrity. The vulnerability requires local attack vector and user interaction, which reduces the likelihood of remote exploitation. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit exposure by restricting access to vulnerable GPAC versions and avoid processing untrusted SVG content. Monitor vendor channels for updates.