Description
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GPAC | 26.07 | abi-16.26 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- VDB-411908 | GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow vdb-entry technical-description
- VDB-411908 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-103227 | CVE Analysis and Report third-party-advisory
- Submit #955033 | gpac GPAC 26.07.0 and below Memory Corruption third-party-advisory
- https://github.com/gpac/gpac/issues/3876 issue-tracking
- https://github.com/gpac/gpac/pull/3879 issue-tracking patch
- https://github.com/gpac/gpac/commit/4c8e26f278ff63eec57968f7bc696f604bb0cffd patch
- https://github.com/gpac/gpac/releases/tag/abi-16.26 patch
- https://github.com/gpac/gpac/ product