EUVD-2026-75128
GHSA-c2fm-vm9m-g9xv
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
5DescriptionCVE.org
An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.
AnalysisAI
Heap-based memory corruption in GPAC's DVB-MPE/DSM-CC transport-stream parser lets an attacker who supplies a crafted MPEG-2 TS file trigger out-of-bounds reads and writes that can be turned into arbitrary code execution in the context of the parsing process. The flaw lives in src/media_tools/dvb_mpe.c in descriptorTime_slice_fec_identifier(), gf_m2ts_ipdatagram_reader() and the DSM-CC section/descriptor loops, and is fixed by commit 0e4093392e1f847c90d20e031e893cd942fef938. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today