GPAC CVE-2026-39103

GPAC is an open-source multimedia framework that implements ISO/IEC standards for digital media. The vulnerability exists in the SVG attribute parsing subsystem (src/scenegraph/svg_attributes.c), specifically in the svg_parse_strings() function called by gf_svg_parse_attribute(). The root cause is a heap buffer overflow (CWE-122) where pointer arithmetic on the 'sep' variable proceeds without checking for null pointer dereference or end-of-string conditions. The code iterates through separator characters (spaces, commas, semicolons) when parsing SVG string attributes, but fails to validate that the pointer remains valid before dereferencing it. The commit fix adds explicit null pointer checks ('!sep || !sep[0]') before accessing sep[0], preventing out-of-bounds access into heap memory.