Fantasy_2026

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket on protocol error in the library lib/facil/http/parsers/websocket parser.h of the component WebSocket Frame Parser. This manipulation of the argument on message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

**Name of the Vulnerable Software and Affected Versions** GPAC version 26.03-DEV-rev342-g80071f700-master **Description** A local issue exists in the TeXML File Handler component within the `txtin probe duration()` function of the `src/filters/load text.c` file. Manipulation of the `txml timescale` argument can lead to a divide by zero condition. **Recommendations** Apply patch 86a5191f2e750c767253e27ed6cfd6d547afebc2 to version 26.03-DEV-rev342-g80071f700-master.

**Name of the Vulnerable Software and Affected Versions** GPAC version 26.03-DEV **Description** An issue exists in the MP4Box component within the `vobsub read idx()` function of the `/src/media tools/vobsub.c` file. A local attacker can trigger an out-of-bounds read by manipulating the `num langs` argument. An out-of-bounds read occurs when a program reads data past the end of the intended buffer, potentially exposing sensitive information from memory. **Recommendations** Apply the patch 532097084729a936bcdf6a27c41003f3bd7dc3ff to version 26.03-DEV.