Vulnerability · Published Sep 18, 2026 · Assigned by VulDB

CVE-2026-93331GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds

High 7.3

In plain English

A high-severity out-of-bounds read in GPAC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. The affected component should be upgraded.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	26.08-DEV

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References

VDB-406641 | GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds vdb-entry, technical-description
VDB-406641 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-93331 | CVE Analysis and Report third-party-advisory
Submit #942834 | GPAC 26.08-DEV Memory Corruption third-party-advisory
https://github.com/gpac/gpac/issues/3868 issue-tracking
https://github.com/gpac/gpac/commit/6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68 patch
https://github.com/gpac/gpac/releases/tag/abi-16.26 patch
https://github.com/gpac/gpac/ product