Description
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
Published: 2026-09-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Patch
AI Analysis

Impact

A buffer overflow exists in the gf_dash_resolve_url function within the DASH Client component of GPAC. The function may overwrite adjacent memory when processing a malformed URL, enabling an attacker to execute arbitrary code or crash the application. Classified as CWE‑119 and CWE‑120, the flaw can be triggered remotely by supplying crafted input to a GPAC instance that resolves URLs, potentially compromising confidentiality, integrity, or availability.

Affected Systems

GPAC multimedia framework up to version 26.07.0 is affected; the vulnerability resides in the DASH Client (src/media_tools/dash_client.c). The vendor recommends upgrading to abi‑16.26, which includes the patch 4c8e26f278ff63eec57968f7bc696f604bb0cffd.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available. The flaw is not listed in the CISA KEV catalog. Attackers can exploit it remotely by supplying a crafted URL to a GPAC instance that resolves external resources, giving them the potential for arbitrary code execution. While no public exploits are reported, the remote trigger and memory corruption suggest a significant risk if the issue is utilized by malicious actors.

Generated by OpenCVE AI on September 30, 2026 at 16:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi-16.26 or later, which incorporates the patch identified by commit 4c8e26f278ff63eec57968f7bc696f604bb0cffd.
  • If immediate upgrade is not feasible, run GPAC instances in a sandboxed environment or with the least privilege required to limit the impact of potential memory corruption.
  • Disable or restrict GPAC’s ability to resolve external URLs unless strictly necessary for the application’s functionality, thereby reducing the attack surface.
  • Monitor system logs and network traffic for abnormal crashes or URL resolution attempts, and investigate any anomalies promptly.

Generated by OpenCVE AI on September 30, 2026 at 16:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
Title GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-02T16:16:01.069Z

Reserved: 2026-09-30T07:49:31.448Z

Link: CVE-2026-103227

cve-icon Vulnrichment

Updated: 2026-10-02T16:14:30.615Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T15:22:26.053

Modified: 2026-10-02T17:17:01.800

Link: CVE-2026-103227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T19:45:14Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')