Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92399

GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92399

Published

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is able to mitigate this issue. This patch is called 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. Upgrading the affected component is recommended.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92399

Published

GPAC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "GPAC",
                    "versions": [
                        {
                            "version": "26.07.0",
                            "status": "affected"
                        },
                        {
                            "version": "abi-16.26",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "WebSocket Handler"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON