CVE-2026-27821highCWE-121

CVE-2026-27821: falha de alta gravidade em gpac

GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow

Publicada em

Seguir esta CVE+ Monitorar GPAC+ Monitorar gpac

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.3%
GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/dmx_nhml.c`. The value of the xmlHeaderEnd XML attribute is copied from att->value into szXmlHeaderEnd[1000] using strcpy() without any length validation. If the input exceeds 1000 bytes, it overwrites beyond the stack buffer boundary. Commit 9bd7137fded2db40de61a2cf3045812c8741ec52 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Produtos afetados
gpac · gpac
CVEs relacionadas — gpac

No mesmo produto, das mais perigosas para as menos.

CVE-2026-33144MEDIUMGPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)EPSS 0.2%CVE-2026-124031MEDIUMGPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4EPSS —CVE-2026-124030MEDIUMGPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-ReplaceEPSS —