Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92475

GPAC downloader.c wait_for_header_and_parse out-of-bounds

CVSS 4.0 4.8 MEDIUMCVSS 3.1 5.3 MEDIUMCVSS 3.0 5.3 MEDIUMCVSS 2.0 4.3 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92475

Published

A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92475

Published

GPAC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "GPAC",
                    "versions": [
                        {
                            "version": "26.08-DEV",
                            "status": "affected"
                        },
                        {
                            "version": "abi-16.26",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON