What is the CVSS score of CVE-2026-103227?

CVE-2026-103227 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-103227?

Yes, a patch is available for CVE-2026-103227. Update the affected software to the latest version immediately.

GPAC CVE-2026-103227

EUVD-2026-89966 MEDIUM

Classic Buffer Overflow (CWE-120)

2026-09-30 VulDB

GHSA-w83x-f8q3-9m4w

Buffer Overflow Github Gpac N A

5.3

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host malicious DASH manifest
Delivery

Victim opens crafted stream in GPAC
Exploit

gf_dash_resolve_url formats blob URL
Execution

Unbounded sprintf overflows out_url buffer
Impact

Memory corruption / client crash

Vulnerability Assessment

Weakness	CWE CWE-120 ASVS 5.0 V15 - Secure Coding and Architecture Buffer copy size validation MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the GPAC DASH client to process an attacker-controlled DASH presentation such that gf_dash_resolve_url resolves an initialization segment to a gmem://blob URL, whose scheme-prefixed formatting overflows the fixed output buffer. It is limited by required user interaction (UI:P) - a victim must open or stream the malicious DASH content - and is confined to GPAC builds up to and including 26.07.0 that use the DASH client path; upgrading to abi-16.26 removes the flaw. No authentication is required (PR:N), but the flaw is not reachable against a system that never ingests attacker-supplied DASH media.
Impact	This is a moderate, not high-priority, issue by all available signals. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) describes a network-reachable but user-interaction-dependent (UI:P - a victim must open/process attacker-controlled DASH content) buffer overflow with only Low impact across confidentiality, integrity, and availability. No EPSS score is provided, this CVE is NOT in CISA KEV, and no public exploit is identified - the GitHub issue (#3876) is a bug report, not weaponized exploit code. The source diff confirms the root cause is a genuine unbounded write: the pre-patch code used sprintf(*out_url, ...) to write a scheme-prefixed gmem:// blob URL (including a %p pointer) into a buffer without bounds checking, and the fix replaces it with snprintf into a correctly gf_realloc'd buffer sized by strlen(scheme)+strlen(b_url)+1. Practically this is most likely to produce a crash/memory corruption in the DASH client rather than reliable code execution, consistent with the vendor's uniformly Low impact ratings. No data is directly conflicting; the main gap is the absence of EPSS and any exploit-maturity signal (E:X in the vector = 'Not Defined'), so real-world exploitation likelihood is best treated as low absent further evidence.
Exploit ScenarioDerived	An attacker hosts or serves a crafted DASH MPD manifest/segment such that when a GPAC-based player or MP4Box-driven pipeline resolves the initialization segment URL via gf_dash_resolve_url, the formatted blob URL overflows the output buffer. A victim who opens or streams this attacker-controlled DASH content triggers the overflow, most plausibly crashing the client (denial of service) with potential for memory corruption. No public proof-of-concept exploit has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 30, 2026

A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.

RemediationAI

Upgrade GPAC to abi-16.26 or later, the vendor-released patch version (https://github.com/gpac/gpac/releases/tag/abi-16.26), or cherry-pick the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd / PR https://github.com/gpac/gpac/pull/3879 which replaces the unchecked sprintf with a size-computed gf_realloc + snprintf; verify the build actually contains the patched dash_client.c, since GPAC is frequently vendored inside media pipelines and container images. Where upgrading is not immediately possible, treat all DASH/MPD input as untrusted: disable or avoid the DASH client path (do not invoke GPAC tools on attacker-supplied manifests, do not use gf_dash_* APIs on remote MPD URLs) and restrict auto-streaming to vetted content, accepting the trade-off that legitimate DASH playback of external sources becomes unavailable. Additional compensating controls: run GPAC under a memory-safe sandbox with ASLR/stack canaries and seccomp to blunt exploitation, and front it with an HTTP proxy that only serves MPD/segment URLs from an allow-list, which narrows but does not eliminate the reachable input space; because the flaw requires the victim to open the malicious presentation (UI:R), blocking automatic loading of remote MPDs and requiring manual confirmation of streaming origins is an effective interim mitigation. Monitor the referenced advisory (https://vuldb.com/vuln/411908) for any revision of affected version ranges, and note there is no confirmed in-the-wild exploitation to prioritize emergency action.

Affected VersionsENISA

GPAC 26.07

Affected Packages

euvd gpac no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

GPAC is a multimedia framework whose DASH client parses MPD manifests and resolves media/initialization segment URLs. The vulnerable function, gf_dash_resolve_url, builds the resolved URL by concatenating a scheme prefix with either a blob handle or a gmem:// pseudo-URL and writing it into *out_url. In the affected code the destination buffer was sized for the pre-resolution URL and the write used an unchecked sprintf-style copy, so an attacker who can influence the id/URL fields of a DASH representation can drive the length of the scheme-prefixed string past the allocation and overflow the buffer - CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow). The upstream patch (PR #3879, commit 4c8e26f2) refactors the path to allocate a dedicated 200-byte blob_url buffer for the gmem://%p form, NULL-check the blob registration, size the final buffer with strlen(scheme)+strlen(b_url)+1, allocate it via gf_realloc, copy with snprintf, and free the intermediate blob pointer. The state of the exploit is bounded by the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L: reachable over the network without credentials, but requiring the victim to load attacker-supplied DASH media; the CVE-org record carries a CVSS 4.0 base of 5.3 with UI:P and low C/I/A impact, consistent with a local memory-safety bug in a media parsing path rather than a pre-auth remote code execution primitive.

Know when Gpac gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

vuln.today AI 6.3 MEDIUM

Remote attacker-supplied DASH content processed by the client (AV:N, PR:N) but the victim must open it (UI:R); a bounded string overflow yields Low memory-corruption impact rather than confirmed code execution.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.

Threat Intelligence Overview

EPSS Score

0.5%

Top 58% exploitable

Prevalence

Medium

widely used open-source multimedia framework/library (GPAC/MP4Box), common but not ubiquitous

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.