Description
A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GPAC | 26.08-DEV | abi-16.26 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- VDB-405734 | GPAC downloader.c wait_for_header_and_parse out-of-bounds vdb-entry technical-description
- VDB-405734 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-92475 | CVE Analysis and Report third-party-advisory
- Submit #941761 | GPAC 26.08-DEV Memory Corruption third-party-advisory
- https://github.com/gpac/gpac/issues/3859 exploit issue-tracking
- https://github.com/gpac/gpac/commit/c74a3065038ede35c1c7b75fa493a69ef6bcdb84 patch
- https://github.com/gpac/gpac/releases/tag/abi-16.26 patch
- https://github.com/gpac/gpac/ product