Description
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
Published: 2026-10-13
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds write that can corrupt memory and allow remote exploitation.
Action: Apply patch
AI Analysis

Impact

A manipulation of the GPAC AIT parser upstream component can trigger an out-of-bounds write in the function gf_m2ts_decode_ait. This flaw involves memory corruption adjacent to the target buffer and can be triggered remotely by sending a crafted packet to a vulnerable GPAC instance. The CVE notes that a public exploit has been disclosed, indicating that the remote attack is technically feasible.

Affected Systems

GPAC versions up to and including 26.07.0 are affected. The flaw resides in the AIT parser within the GPAC media tools library, specifically in src/media_tools/ait.c; no other vendors or products are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate level of severity. The EPSS score is not available, so the precise likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, but a public exploit is available, meaning unpatched installations are susceptible to remote exploitation.

Generated by OpenCVE AI on October 13, 2026 at 20:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the patch corresponding to commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 to fix the out-of-bounds write.
  • Upgrade GPAC to a release newer than 26.07.0, or rebuild GPAC from a source that includes the upstream patch.
  • If an upgrade is not immediately feasible, disable or remove the AIT parser feature to eliminate the attack surface.

Generated by OpenCVE AI on October 13, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
Title GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-787
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:11:47.862Z

Reserved: 2026-10-13T04:55:11.244Z

Link: CVE-2026-109827

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:15.765Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:31.697

Modified: 2026-10-15T16:17:44.843

Link: CVE-2026-109827

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T21:00:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write