CVE-2026-13523

GPAC ISOBMFF base_encoding.c data amplification

State: Published
Severity: 4.8 Medium
Published: Jun 29, 2026
Updated: Jun 29, 2026
Reserved: Jun 28, 2026

Description

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-409 Highly Compressed Data
CWE-404 Denial of Service

Affected Products

Product	Versions
GPACn/a	26.02Affected

References

VDB-374531 | GPAC ISOBMFF base_encoding.c data amplificationvdb-entry
VDB-374531 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-13523 | CVE Analysis and Reportthird-party-advisory
Submit #840159 | GPAC <= 26.02.0 Uncontrolled Resource Consumptionthird-party-advisory
https://github.com/gpac/gpac/issues/3588exploitissue-tracking
https://github.com/gpac/gpac/pull/3589issue-trackingpatch
https://github.com/gpac/gpac/commit/297f2d8d1f493d8b241330533cd47f7da758aeb3patch
https://github.com/gpac/gpac/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.