Out-of-Bounds Read Vulnerability in GPAC MP4Box
CVE-2026-15185

4.8MEDIUM

Key Information:

Vendor: GPAC
Status: Gpac
Vendor: CVE Published:; 9 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-15185?

A vulnerability has been identified in GPAC's MP4Box, specifically in the vobsub_read_idx function found within the /src/media_tools/vobsub.c file. A local attacker can exploit this vulnerability by manipulating the num_langs argument, potentially leading to an out-of-bounds read. The exploit has been made public and may pose a significant security risk. To mitigate this vulnerability, it is strongly recommended to apply the available patches, which include two separate commits that address the issue adequately.

Affected Version(s)

GPAC 26.03-DEV

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15185 - Proof of Concept