CVE-2026-15185 - Vulnerability Details

- GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

Description

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.

Published: 2026-07-09

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vobsub_read_idx function in GPAC’s MP4Box tool contains an out‑of‑bounds read vulnerability that can be triggered by supplying a manipulated num_langs argument. This flaw allows a local attacker to read memory beyond the intended buffer, potentially exposing confidential data. The weakness is documented as both CWE-119 (improper restriction of operations within buffer bounds) and CWE-125 (out‑of‑bounds read).

Affected Systems

GPAC 26.03-DEV and earlier versions, including binaries built with the native MP4Box component, are affected whenever the vobsub module is enabled. The vulnerability is present only when an attacker can run MP4Box on crafted media files and supply a corrupted num_langs parameter.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and the EPSS score of <1% reflects a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalogue. Because exploitation requires local execution of MP4Box on malicious input, the threat is confined to environments where privileged or local users can run the tool on untrusted media files.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

GPAC

affected

Version	Status	Constraints
`26.03-DEV`	affected	—

No data.

Vendor Product Confidence Versions

Gpac

95%

Version	Status	Scheme	Platform
`26.03-DEV`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest GPAC release (e.g., v26.03-DEV or later) that includes the patch commit 532097084729a936bcdf6a27c41003f3bd7dc3ff.
If an update cannot be applied immediately, restrict execution of MP4Box to trusted users or disable the vobsub module when processing media from untrusted sources.
Implement sandboxing or staging procedures so that MP4Box runs in a confined environment where memory reads cannot leak sensitive data (e.g., use containerization or SELinux policies).

Generated by OpenCVE AI on July 31, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00112.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/gpac/gpac/
https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff
https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81
https://github.com/gpac/gpac/issues/3611
https://vuldb.com/cve/CVE-2026-15185
https://vuldb.com/submit/851214
https://vuldb.com/vuln/377111
https://vuldb.com/vuln/377111/cti

History

Thu, 09 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 09 Jul 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Title		GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
First Time appeared		Gpac Gpac gpac
Weaknesses		CWE-119 CWE-125
CPEs		cpe:2.3:a:gpac:gpac::::::::
Vendors & Products		Gpac Gpac gpac
References		https://github.com/gpac/gpac/ https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81 https://github.com/gpac/gpac/issues/3611 https://vuldb.com/cve/CVE-2026-15185 https://vuldb.com/submit/851214 https://vuldb.com/vuln/377111 https://vuldb.com/vuln/377111/cti
Metrics		cvssV2_0 `{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Gpac Gpac

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-07-09T12:30:08.948Z

Updated: 2026-07-09T14:41:36.729Z

Reserved: 2026-07-09T05:03:19.664Z

Link: CVE-2026-15185

Vulnrichment

Updated: 2026-07-09T14:41:32.532Z

NVD

Status : Deferred

Published: 2026-07-09T14:16:29.537

Modified: 2026-07-09T16:19:45.567

Link: CVE-2026-15185

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T13:30:17Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object