PT-2026-24938 · Debian+2 · Gpac

Breakingbad · Publicado 2026-01-01 · Atualizado 2026-03-13 · CVE-2026-4016

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GPAC version 26.03-DEV

Description A security issue has been identified in GPAC 26.03-DEV. The svgin process function within the SVG Parser component, located in the file src/filters/load svg.c, is susceptible to an out-of-bounds write condition. Local access is required for exploitation. The exploit for this issue has been publicly disclosed. The patch identifier is 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2.

Recommendations Install the patch with identifier 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2 to address this issue.

Exploit

Correção

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-119

CWE-787

Identificadores relacionados

CVE-2026-4016

Produtos afetados

Gpac

Referências · 19

• 🔥❌ https://github.com/user-attachments/files/25494042/poc_dims_oob.py · Exploit, Deleted
• https://github.com/gpac/gpac/issues/3468 · Nota
• https://github.com/gpac/gpac/commit/7618d7206cdeb3c28961dc97ab0ecabaff0c8af2 · Correção
• https://ubuntu.com/security/CVE-2026-4016 · Aviso do Fabricante
• https://github.com/gpac/gpac · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4016 · Nota de Segurança
• https://vuldb.com/?id.350538 · Nota
• https://osv.dev/vulnerability/CVE-2026-4016 · Aviso do Fabricante
• https://t.me/cveNotify/155246 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032410973408260457 · Publicação no Twitter
• https://vuldb.com/?ctiid.350538 · Nota
• https://twitter.com/CVEarity/status/2032091467095900440 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-4016 · Nota de Segurança
• https://vuldb.com/?submit.769798 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4016 · Aviso do Fabricante