CVE-2026-92475
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A weakness has been identified in GPAC 26.08-DEV affecting the function wait_for_header_and_parse of the file src/utils/downloader.c. Manipulation of the Content-Range argument causes an out-of-bounds read. The attack requires local access, and the exploit has been made publicly available and could be used for attacks. Upgrading to version abi-16.26 fixes this issue (patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84).
Risk Assessment
A local attacker could trigger an out-of-bounds read, potentially leading to data disclosure or application crash. The risk is increased by the publicly available exploit.
Recommendation
Upgrade GPAC to version abi-16.26 or apply patch c74a3065038ede35c1c7b75fa493a69ef6bcdb84. Until then, restrict local access to trusted users.
Other vulnerabilities in GPAC
See all- CVE-2026-92474Low
A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.
- CVE-2026-92472Low
A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2026-88339Medium
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
- CVE-2026-93331High
A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_rtp_parse_ttxt in src/ietf/rtp_depacketizer.c of the RTP Depacketizer component. Manipulation of the size argument leads to an out-of-bounds read. The attack can be launched remotely.
- CVE-2026-92473Low
A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_sg_command_del in src/scenegraph/commands.c (BIFS Handler component). The manipulation leads to a use-after-free condition, and the attack requires local access. The exploit is publicly available and might be used.
Original NVD description (English source)
A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS