PT-2026-24938 · Debian+2 · Gpac

Breakingbad · Published 2026-01-01 · Updated 2026-03-13 · CVE-2026-4016

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GPAC version 26.03-DEV

Description A security issue has been identified in GPAC 26.03-DEV. The svgin process function within the SVG Parser component, located in the file src/filters/load svg.c, is susceptible to an out-of-bounds write condition. Local access is required for exploitation. The exploit for this issue has been publicly disclosed. The patch identifier is 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2.

Recommendations Install the patch with identifier 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2 to address this issue.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

CVE-2026-4016

Affected Products

Gpac

References · 19

• 🔥❌ https://github.com/user-attachments/files/25494042/poc_dims_oob.py · Exploit, Deleted
• https://github.com/gpac/gpac/commit/7618d7206cdeb3c28961dc97ab0ecabaff0c8af2 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4016 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-4016 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-4016 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4016 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4016 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4016 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4016 · Vendor Advisory
• https://github.com/gpac/gpac/issues/3468 · Note
• https://vuldb.com/?ctiid.350538 · Note
• https://github.com/gpac/gpac · Note
• https://vuldb.com/?id.350538 · Note
• https://vuldb.com/?submit.769798 · Note
• https://twitter.com/CVEarity/status/2032091467095900440 · Twitter Post