EUVD-2026-42590
GHSA-fp8c-v4q6-8572
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low privileges to supply crafted input; only low availability impact, no confidentiality or integrity loss, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
AnalysisAI
Out-of-bounds read in GPAC MP4Box version 26.03-DEV allows local low-privileged attackers to cause a low-severity availability impact by supplying a crafted input that manipulates the num_langs argument in the vobsub_read_idx function of vobsub.c. A proof-of-concept exploit has been publicly disclosed via GitHub issue #3611 and the CVSS 4.0 E:P modifier confirms its availability. Two upstream commits have been applied to address the flaw, though no standalone patched release version has been independently confirmed.
Technical ContextAI
GPAC is an open-source multimedia framework; MP4Box is its primary media packaging and analysis tool. The vulnerable function vobsub_read_idx in /src/media_tools/vobsub.c handles parsing of VobSub subtitle index files (.idx), which encode metadata including language count fields. CWE-125 (Out-of-Bounds Read) is the root cause: when num_langs is manipulated beyond a valid range, the function reads memory outside the intended buffer boundary. Although tagged 'Buffer Overflow' in the intelligence data, the CVSS 4.0 vector (VC:N/VI:N/VA:L) confirms the impact is limited to a low availability effect - a crash or undefined behavior - with no confirmed confidentiality or integrity impact. The CPE entry (cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:*) covers the gpac application without a vendor namespace, consistent with its independent open-source status.
RemediationAI
Apply the two upstream patch commits directly to the GPAC source tree: 532097084729a936bcdf6a27c41003f3bd7dc3ff and aa0fb77b82e51b159a2024c440cdf6b571b14d81, both available at https://github.com/gpac/gpac/. A specific patched release version has not been independently confirmed - the fix is available only as upstream commits at time of analysis, so users should build from the patched HEAD or monitor the GPAC release page for a versioned release incorporating these fixes. As a compensating control, restrict processing of untrusted or externally sourced VobSub (.idx/.sub) files through MP4Box in automated pipelines, or sandbox the MP4Box process using tools such as bubblewrap or firejail to limit the blast radius of a crash or potential memory disclosure to the process itself.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today