CVE-2026-52489
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code, potentially leading to system or data compromise.
Recommendation
Update gpac to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in gpac
See all- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2026-50810Medium
A NULL pointer dereference vulnerability exists in the smooth_parse_stream_index() function in src/media_tools/mpd.c of GPAC. The issue is fixed in commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.
- CVE-2025-15668Low
A vulnerability was found in GPAC up to b40ce70f5 in the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the MP4Box component. Manipulation of the data argument leads to a heap-based buffer overflow. Local access is required and the exploit is publicly available.
- CVE-2025-15667Low
A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.
- CVE-2026-14801Low
A security vulnerability was detected in GPAC 26.03-DEV-rev342-g80071f700-master in the function txtin_probe_duration of the file src/filters/load_text.c of the TeXML File Handler component. Manipulation of the argument txml_timescale leads to a divide by zero. The attack requires local access.
- CVE-2026-14790Low
A flaw in GPAC 26.02.0 affects the nhmldump_send_frame function in src/filters/write_nhml.c of the Media File Handler component, leading to a null pointer dereference. The attack requires local access and an exploit has been published.
Original NVD description (English source)
Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function