Arbitrary Code Execution Vulnerability in GPAC by GPAC Project
CVE-2026-71614

8.4HIGH

Key Information:

Vendor

GPAC Project

Status
GPAC
Vendor
CVE Published:
9 September 2026

What is CVE-2026-71614?

The GPAC library has a significant security vulnerability that allows attackers to execute arbitrary code. This issue arises from the src/media_tools/dvb_mpe.c file, specifically within the descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() functions. When exploited, this vulnerability could lead to unauthorized access and control over the affected system. A fix has been implemented in the version identified by the commit 0e4093392e1f847c90d20e031e893cd942fef938.

References

https://github.com/gpac/gpac/issues/3614
https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20...

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.