Description
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Published: 2026-07-09
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The MP4Box tool in GPAC contains a flaw in the vobsub_read_idx function that can be triggered by supplying a manipulated num_langs argument. When exploited, this causes an out‑of‑bounds read, allowing the local attacker to read unintended data from the process’s address space and potentially expose confidential information. The weakness is a classic buffer over‑read (CWE‑125).

Affected Systems

GPAC 26.03‑DEV and earlier versions, when built from source or used with the native MP4Box binary, contain the vulnerable code. The issue is confined to systems where a user can execute MP4Box with crafted input to the vobsub module.

Risk and Exploitability

The CVSS rating of 4.8 denotes moderate severity. The EPSS score of <1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalogue. Because the exploit requires local execution of the tool on untrusted input, the threat is limited to environments where privileged or local users can run MP4Box on potentially malicious media files.

Generated by OpenCVE AI on July 26, 2026 at 15:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GPAC to a release that includes the commit 532097084729a936bcdf6a27c41003f3bd7dc3ff, which patches vobsub_read_idx.
  • If immediate update is not possible, rebuild GPAC from the updated source and restrict MP4Box usage to trusted users or execute it within a sandbox to prevent processing of untrusted input.
  • If vobsub support is not needed, disable or remove the vobsub module from the MP4Box build to eliminate the vulnerable code path.

Generated by OpenCVE AI on July 26, 2026 at 15:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 09 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Title GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-09T14:41:36.729Z

Reserved: 2026-07-09T05:03:19.664Z

Link: CVE-2026-15185

cve-icon Vulnrichment

Updated: 2026-07-09T14:41:32.532Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T15:30:04Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read