EUVD-2026-89966
GHSA-w83x-f8q3-9m4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious DASH manifest
-
DeliveryVictim opens crafted stream in GPAC
-
Exploitgf_dash_resolve_url formats blob URL
-
ExecutionUnbounded sprintf overflows out_url buffer
-
ImpactMemory corruption / client crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the GPAC DASH client to process an attacker-controlled DASH presentation such that gf_dash_resolve_url resolves an initialization segment to a gmem://blob URL, whose scheme-prefixed formatting overflows the fixed output buffer. It is limited by required user interaction (UI:P) - a victim must open or stream the malicious DASH content - and is confined to GPAC builds up to and including 26.07.0 that use the DASH client path; upgrading to abi-16.26 removes the flaw. No authentication is required (PR:N), but the flaw is not reachable against a system that never ingests attacker-supplied DASH media. |
| Impact | This is a moderate, not high-priority, issue by all available signals. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L, score 5.3) describes a network-reachable but user-interaction-dependent (UI:P - a victim must open/process attacker-controlled DASH content) buffer overflow with only Low impact across confidentiality, integrity, and availability. No EPSS score is provided, this CVE is NOT in CISA KEV, and no public exploit is identified - the GitHub issue (#3876) is a bug report, not weaponized exploit code. The source diff confirms the root cause is a genuine unbounded write: the pre-patch code used sprintf(*out_url, ...) to write a scheme-prefixed gmem:// blob URL (including a %p pointer) into a buffer without bounds checking, and the fix replaces it with snprintf into a correctly gf_realloc'd buffer sized by strlen(scheme)+strlen(b_url)+1. Practically this is most likely to produce a crash/memory corruption in the DASH client rather than reliable code execution, consistent with the vendor's uniformly Low impact ratings. No data is directly conflicting; the main gap is the absence of EPSS and any exploit-maturity signal (E:X in the vector = 'Not Defined'), so real-world exploitation likelihood is best treated as low absent further evidence. |
| Exploit ScenarioDerived | An attacker hosts or serves a crafted DASH MPD manifest/segment such that when a GPAC-based player or MP4Box-driven pipeline resolves the initialization segment URL via gf_dash_resolve_url, the formatted blob URL overflows the output buffer. A victim who opens or streams this attacker-controlled DASH content triggers the overflow, most plausibly crashing the client (denial of service) with potential for memory corruption. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
A heap/stack buffer overflow in the GPAC DASH client's URL resolution routine (gf_dash_resolve_url in src/media_tools/dash_client.c) lets a remote attacker corrupt memory by supplying a crafted DASH presentation whose initialization segment resolves to a scheme-prefixed gmem://blob URL, which is then written into an undersized output buffer. All GPAC builds up to and including 26.07.0 that exercise the DASH client path are affected; the attacker cannot reach the flaw unless a victim opens or streams the malicious DASH content (user interaction required) and no authentication is needed, with impact limited to low confidentiality, integrity and availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vendor has released abi-16.26 plus the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd, making this a moderate, low-priority-by-signal issue.
RemediationAI
Upgrade GPAC to abi-16.26 or later, the vendor-released patch version (https://github.com/gpac/gpac/releases/tag/abi-16.26), or cherry-pick the upstream fix commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd / PR https://github.com/gpac/gpac/pull/3879 which replaces the unchecked sprintf with a size-computed gf_realloc + snprintf; verify the build actually contains the patched dash_client.c, since GPAC is frequently vendored inside media pipelines and container images. Where upgrading is not immediately possible, treat all DASH/MPD input as untrusted: disable or avoid the DASH client path (do not invoke GPAC tools on attacker-supplied manifests, do not use gf_dash_* APIs on remote MPD URLs) and restrict auto-streaming to vetted content, accepting the trade-off that legitimate DASH playback of external sources becomes unavailable. Additional compensating controls: run GPAC under a memory-safe sandbox with ASLR/stack canaries and seccomp to blunt exploitation, and front it with an HTTP proxy that only serves MPD/segment URLs from an allow-list, which narrows but does not eliminate the reachable input space; because the flaw requires the victim to open the malicious presentation (UI:R), blocking automatic loading of remote MPDs and requiring manual confirmation of streaming origins is an effective interim mitigation. Monitor the referenced advisory (https://vuldb.com/vuln/411908) for any revision of affected version ranges, and note there is no confirmed in-the-wild exploitation to prioritize emergency action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GPAC is a multimedia framework whose DASH client parses MPD manifests and resolves media/initialization segment URLs. The vulnerable function, gf_dash_resolve_url, builds the resolved URL by concatenating a scheme prefix with either a blob handle or a gmem:// pseudo-URL and writing it into *out_url. In the affected code the destination buffer was sized for the pre-resolution URL and the write used an unchecked sprintf-style copy, so an attacker who can influence the id/URL fields of a DASH representation can drive the length of the scheme-prefixed string past the allocation and overflow the buffer - CWE-120 (Buffer Copy without Checking Size of Input, classic buffer overflow). The upstream patch (PR #3879, commit 4c8e26f2) refactors the path to allocate a dedicated 200-byte blob_url buffer for the gmem://%p form, NULL-check the blob registration, size the final buffer with strlen(scheme)+strlen(b_url)+1, allocate it via gf_realloc, copy with snprintf, and free the intermediate blob pointer. The state of the exploit is bounded by the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L: reachable over the network without credentials, but requiring the victim to load attacker-supplied DASH media; the CVE-org record carries a CVSS 4.0 base of 5.3 with UI:P and low C/I/A impact, consistent with a local memory-safety bug in a media parsing path rather than a pre-auth remote code execution primitive.
Know when Gpac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Remote attacker-supplied DASH content processed by the client (AV:N, PR:N) but the victim must open it (UI:R); a bounded string overflow yields Low memory-corruption impact rather than confirmed code execution.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Exploit-DB