{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"gpac","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:11","exploited":false,"fixed_versions":[],"id":"tcs_01M5NRW2RN6XJQ9VMJKDY8JKQK","modified_at":"2026-08-27T23:06:01.600117029Z","published_at":"2026-05-05T16:16:12.993Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-39103","https://security-tracker.debian.org/tracker/CVE-2026-39103"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-39103","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-39103"}],"summary":"Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings"}