CVE-2026-8124

EUVD-2026-28483
A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.3 LOW
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 5.57%
Affected Products (NVD)
VendorProductVersion
gpacgpac
𝑥
≤ 26.02.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
gpac
bullseye
vulnerable
bullseye (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gpac
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
dne
resolute
dne
trusty
needs-triage
xenial
ignored
Common Weakness Enumeration
References
https://github.com/gpac/gpac/
https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318ba
https://github.com/gpac/gpac/issues/3519
https://vuldb.com/submit/808611
https://vuldb.com/vuln/361914
https://vuldb.com/vuln/361914/cti