EUVD-2026-25873Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector, low privilege; user must process attacker-supplied MP4; OOB read yields confidentiality and availability impact only, not integrity.
Primary rating from NVD.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file src/isomedia/box_code_base.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.
AnalysisAI
Out-of-bounds read in GPAC's elng_box_read function allows local attackers to trigger partial information disclosure and potential availability impact by supplying a crafted MP4 file with an oversized Extended Language Tag (elng) box. The fix commit confirms the root cause: ptr->size is not validated against GF_UINT_MAX before use, permitting a read beyond allocated memory. A publicly available proof-of-concept exploit exists (GitHub issue #3516), though EPSS sits at 0.01% and SSVC classifies exploitation as non-automatable with only partial technical impact - placing real-world priority well below the noise floor for most organizations.
Technical ContextAI
GPAC is an open-source multimedia framework and the MP4Box command-line tool processes ISO Base Media File Format (ISOBMFF / MP4) containers. The vulnerable component is the elng box reader in src/isomedia/box_code_base.c, which handles the Extended Language Tag box type defined in ISO 14496-12. CWE-125 (Out-of-Bounds Read) applies: the code reads from a buffer offset calculated using ptr->size without first checking whether ptr->size exceeds GF_UINT_MAX, causing the read to extend past the intended allocation boundary when a crafted MP4 presents an oversized elng box. The companion fix in isom_intern.c also guards against integer overflow in mediaTime arithmetic (ent->mediaTime + mediaTime_increment overflowing GF_INT64_MAX), suggesting the same malformed file can trigger both issues. CPE: cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:* up to and including version 26.03-DEV-rev105-g8f39a1eb3-master.
RemediationAI
Upgrade GPAC to release abi-16.8 (https://github.com/gpac/gpac/releases/tag/abi-16.8), which includes patch commit cf6ac48c972eaaee2af270adc3f36615325deb3e. This commit adds a size validation guard (ptr->size > GF_UINT_MAX returns GF_ISOM_INVALID_FILE) in elng_box_read and a companion overflow check in GetMediaTime within isom_intern.c. If immediate upgrade is not feasible, restrict the inputs processed by MP4Box to trusted sources only - specifically, do not allow untrusted or user-supplied MP4 files to be fed into GPAC pipelines without sanitization or sandboxing. Running MP4Box inside an unprivileged container or sandbox (e.g., seccomp, bubblewrap) limits the attacker's ability to escalate beyond a crash or minor information read. No functional workaround that preserves elng box processing while eliminating the OOB condition is available without the patch.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today