Home

Description

A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file src/isomedia/box_code_base.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.

PUBLISHED Reserved 2026-04-26 | Published 2026-04-27 | Updated 2026-04-27 | Assigner VulDB




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
MEDIUM: 5.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
4.3AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Problem types

Out-of-Bounds Read

Memory Corruption

Timeline

2026-04-26:Advisory disclosed
2026-04-26:VulDB entry created
2026-04-26:VulDB entry last update

Credits

Lucian-2333 (VulDB User) reporter

References

vuldb.com/vuln/359734 (VDB-359734 | GPAC MP4Box box_code_base.c elng_box_read out-of-bounds) vdb-entry technical-description

vuldb.com/vuln/359734/cti (VDB-359734 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/submit/800985 (Submit #800985 | gpac laster Memory Corruption) third-party-advisory

github.com/gpac/gpac/issues/3516 exploit issue-tracking

github.com/...ommit/cf6ac48c972eaaee2af270adc3f36615325deb3e patch

github.com/gpac/gpac/releases/tag/abi-16.8 patch

github.com/gpac/gpac/ product

cve.org (CVE-2026-7135)

nvd.nist.gov (CVE-2026-7135)

Download JSON