CVE-2026-7135 Details
Description
A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elng_box_read of the file src/isomedia/box_code_base.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.
A heap out-of-bounds read and write vulnerability has been identified in GPAC versions prior to 26.03-DEV-rev105-g8f39a1eb3-master. The issue arises in the MP4Box component, specifically within the 'elng_box_read' function of 'src/isomedia/box_code_base.c'. This vulnerability is triggered by an integer truncation error when the 'elng' box's payload size, stored as a 64-bit value, is incorrectly cast to a 32-bit integer for memory allocation. As a result, the function can read and potentially write data approximately 4 GB beyond the allocated buffer, leading to memory corruption.
Users are advised to upgrade to GPAC version 26.03-DEV or later. The specific patch for this vulnerability is included in the latest release.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gpac/gpac/ | [email protected] | Vendor |
| https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e | [email protected] | Source CodeVendor |
| https://github.com/gpac/gpac/issues/3516 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/gpac/gpac/releases/tag/abi-16.8 | [email protected] | Vendor |
| https://vuldb.com/submit/800985 | [email protected] | Technical Description |
| https://vuldb.com/vuln/359734 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/359734/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GPAC | <= 26.03-DEV-rev105-g8f39a1eb3-master |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |