PT-2026-38628 · Gpac · Gpac

Lucian-2333 · Published 2026-05-08 · Updated 2026-05-10 · CVE-2026-8124

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 26.02.0

Description A flaw in the sidx box read() function within the src/isomedia/box code base.c file allows for the allocation of resources through manipulation. This issue requires local access to be exploited.

Recommendations Install the patch identified as 442e2299530138d8f874fd885c565ba98a6318ba.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-8124

Affected Products

Gpac

References · 15

• 🔥 https://github.com/gpac/gpac/issues/3519 · Exploit
• 🔥 https://vuldb.com/submit/808611 · Exploit
• https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318ba · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8124 · Security Note
• https://ubuntu.com/security/CVE-2026-8124 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-8124 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8124 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-8124 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-8124 · Vendor Advisory
• https://twitter.com/CVEnew/status/2053559144360051159 · Twitter Post
• https://github.com/gpac/gpac · Note
• https://vuldb.com/vuln/361914 · Note
• https://vuldb.com/vuln/361914/cti · Note
• https://t.me/cveNotify/162652 · Telegram Post
• https://twitter.com/CVEarity/status/2052756563757248549 · Twitter Post