This vulnerability in GPAC up to version 26.02.0 affects the sidx_box_read function, where local manipulation can lead to improper allocation of resources. The attack vector requires local access with low privileges and no user interaction. The CVSS 4.8 score reflects a medium severity with low attack complexity and no privileges required beyond local access. Although exploit code is publicly available, no confirmed official patch or remediation level is specified, but a patch commit has been identified.

The vulnerability allows a local attacker to manipulate the sidx_box_read function leading to resource allocation issues, which could potentially cause denial of service or other resource exhaustion impacts. There is no indication of remote exploitation or privilege escalation. The exploit requires local access and low privileges, limiting the attack surface.

A patch identified by commit 442e2299530138d8f874fd885c565ba98a6318ba is suggested to address this vulnerability. However, no official vendor advisory or confirmation of patch availability is provided. It is recommended to apply this patch if available from the GPAC project or maintainers. Since this is a local attack, restricting local access to trusted users can reduce risk. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.