CVE-2026-109827

6.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-119, CWE-787

Impact

Remote attackers can trigger memory corruption, crashes, or potential code execution by getting a user or service to process a malicious media file. A public exploit is available.

Root cause

An out-of-bounds write occurs in the gf_m2ts_decode_ait function within src/media_tools/ait.c when parsing AIT metadata.

Affected systems

GPAC versions up to and including 26.07.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Fix & remediation

Apply commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 or upgrade to a GPAC build containing PR 3932; no standalone configuration mitigation is provided.

shell

$ git pull && git checkout 6d2c21a1a688abb20d0111b608db3b6f44d348f4

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109827