CVE-2026-8124
mediumA security vulnerability has been detected in GPAC up to 26.02.0.
Vendor / product: Gpac — gpac
A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.
CVSS
5.5
5.5 (CVSS v3.1)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-05-08 02:16
Modified: 2026-11-11 23:10
NVD status: Analyzed
Last synced 3 hours ago
Verified against the source API 2026-11-11 23:13 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
gpac / gpac ≤26.02.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318ba
References
- https://github.com/gpac/gpac/ cna@vuldb.com
- https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318ba cna@vuldb.com
- https://github.com/gpac/gpac/issues/3519 cna@vuldb.com
- https://vuldb.com/submit/808611 cna@vuldb.com
- https://vuldb.com/vuln/361914 cna@vuldb.com
- https://vuldb.com/vuln/361914/cti cna@vuldb.com
Data sources
NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗