The vulnerability exists in the vobsub_read_idx function of the /src/media_tools/vobsub.c file within the MP4Box component of GPAC 26.03-DEV. By manipulating the num_langs argument, an attacker with local privileges can trigger an out-of-bounds read. The vulnerability has been publicly disclosed, and a patch identified by commit 532097084729a936bcdf6a27c41003f3bd7dc3ff has been applied in two separate commits to address the issue. The affected versions include multiple Ubuntu package builds of GPAC, specifically versions =0.5.2-426-gc5ad4e4+dfsg5-1build1 through =2.2.1+dfsg1-3.1build2 as listed.

An attacker with local access can exploit this vulnerability to cause an out-of-bounds read, which may lead to information disclosure or application instability. The vulnerability does not require user interaction and has a low attack complexity. There is no indication of remote exploitation or privilege escalation from the provided data.

A patch fixing this vulnerability has been developed and applied in two commits. It is recommended to apply the available patch identified by commit 532097084729a936bcdf6a27c41003f3bd7dc3ff to affected versions of GPAC. Since this is not a cloud service, users must update their local installations accordingly. Patch status is confirmed by the presence of the patch commit; no vendor advisory contradicts this.