Description
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a GPAC
26.03-DEVaffected
References
- https://vuldb.com/vuln/377111 ↗
- https://vuldb.com/vuln/377111/cti ↗
- https://vuldb.com/cve/CVE-2026-15185 ↗
- https://vuldb.com/submit/851214 ↗
- https://github.com/gpac/gpac/issues/3611 ↗
- https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81 ↗
- https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff ↗
- https://github.com/gpac/gpac/ ↗