CVE-2026-15185
LowCVSS 3.3Summary
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
Risk Assessment
The risk involves potential local out-of-bounds memory read, which could lead to disclosure of sensitive information or system instability. The public exploit increases the likelihood of exploitation.
Recommendation
Apply the patch identified as 532097084729a936bcdf6a27c41003f3bd7dc3ff or upgrade to a newer GPAC version. Restrict local system access to trusted users only.
Original NVD description (English source)
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.