What is the CVSS score of EUVD-2026-13782?

EUVD-2026-13782 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gpac are affected by EUVD-2026-13782?

Organizations using GPAC should be aware of moderate risk from CVE-2026-33144, a out-of-bounds write vulnerability rated CVSS 5.8. Exploitation could cause memory corruption or application crashes.. A patch is available.

How to fix or mitigate EUVD-2026-13782?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Gpac EUVD-2026-13782

| CVE-2026-33144 MEDIUM

Out-of-bounds Write (CWE-787)

2026-03-20 GitHub_M

Memory Corruption Buffer Overflow Gpac

5.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.8 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

86b0e36ea4c71402fbdaf7e13d73ba8841003e72

EUVD ID Assigned

Mar 20, 2026 - 20:30 euvd

EUVD-2026-13782

Analysis Generated

Mar 20, 2026 - 20:30 vuln.today

CVE Published

Mar 20, 2026 - 20:07 nvd

MEDIUM 5.8

DescriptionGitHub Advisory

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.

AnalysisAI

Heap-based buffer overflow in GPAC MP4Box's XML parsing function allows local attackers to corrupt memory and potentially crash the application or achieve code execution by crafting malicious NHML files with specially formatted BitSequence elements. The vulnerability affects systems processing untrusted multimedia files and remains unpatched as of this advisory. Exploitation requires user interaction to open a malicious file.

Technical ContextAI

GPAC (General Purpose Audio/Video Codec framework) is an open-source multimedia toolkit that includes MP4Box, a command-line utility for processing NHML files and other multimedia containers. The root cause is a classic CWE-787 (Out-of-bounds Write) vulnerability in the utils/xml_bin_custom.c module, specifically in the gf_xml_parse_bit_sequence_bs function which processes BitSequence (BS) XML elements without proper bounds validation. When parsing maliciously crafted NHML files containing oversized or specially crafted BS elements, the parser writes beyond allocated heap buffer boundaries. GPAC is distributed as cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*, affecting all versions prior to the patched commit. This vulnerability is particularly relevant for users processing untrusted multimedia metadata files.

RemediationAI

Update GPAC to a version that includes commit 86b0e36 or later. Users should pull the latest code from the main branch or wait for the next stable release that incorporates the patch. Until patching is possible, implement defense-in-depth measures: restrict MP4Box access to trusted users and local processes, disable processing of NHML files from untrusted sources, and implement file integrity monitoring on NHML inputs. Organizations should monitor the official GitHub repository (https://github.com/gpac/gpac) and the security advisory (https://github.com/gpac/gpac/security/advisories/GHSA-3jw5-9pmw-vmfg) for official release notifications when a patched version becomes available.