CVE-2026-33144mediumCWE-787

CVE-2026-33144: falha de média gravidade em gpac

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)

Publicada em

Seguir esta CVE+ Monitorar GPAC+ Monitorar gpac

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.8epss 0.2%
GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Produtos afetados
gpac · gpac
CVEs relacionadas — gpac

No mesmo produto, das mais perigosas para as menos.

CVE-2026-27821HIGHGPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer OverflowEPSS 0.3%CVE-2026-124031MEDIUMGPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4EPSS —CVE-2026-124030MEDIUMGPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-ReplaceEPSS —