Vulnerability · Published May 8, 2026 · Assigned by VulDB

CVE-2026-8124GPAC box_code_base.c sidx_box_read allocation of resources

Low 3.3

In plain English

A low-severity resource allocation without limits in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 94.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	26.02

Weakness: CWE-770, CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-361914 | GPAC box_code_base.c sidx_box_read allocation of resources vdb-entry, technical-description
VDB-361914 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #808611 | gpac latest Denial of Service (DoS) third-party-advisory
https://github.com/gpac/gpac/issues/3519 exploit, issue-tracking
https://github.com/gpac/gpac/commit/442e2299530138d8f874fd885c565ba98a6318ba patch
https://github.com/gpac/gpac/ product