GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds
cve-program · CVE-2026-93331
PublishedA vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. The affected component should be upgraded.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-93331 · CVE overview and exploitation status
cve-program · CVE-2026-93331
- https://vuldb.com/vuln/406641
- https://vuldb.com/vuln/406641/cti
- https://vuldb.com/cve/CVE-2026-93331
- https://vuldb.com/submit/942834
- https://github.com/gpac/gpac/issues/3868
- https://github.com/gpac/gpac/commit/6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68
- https://github.com/gpac/gpac/releases/tag/abi-16.26
- https://github.com/gpac/gpac/
Related changes
Linked by CVE identifierNo related changes are available here.