CVE-2026-8124

GPAC box_code_base.c sidx_box_read allocation of resources

State: Published
Severity: 4.8 Medium
Published: May 8, 2026
Updated: May 8, 2026
Reserved: May 7, 2026

Description

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.3 Low	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	3.3 Low	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	1.7 Low	AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-770 Allocation of Resources
CWE-400 Resource Consumption

Affected Products

Product	Versions
GPACn/a	26.02Affected

References

VDB-361914 | GPAC box_code_base.c sidx_box_read allocation of resourcesvdb-entrytechnical-description
VDB-361914 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #808611 | gpac latest Denial of Service (DoS)third-party-advisory
https://github.com/gpac/gpac/issues/3519exploitissue-tracking
https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318bapatch
https://github.com/gpac/gpac/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.