A vulnerability has been found in GPAC up to 26.07.0. (CVE-2026-109827)
Description
A vulnerability in GPAC up to version 26.07.0 affects the AIT Parser component, specifically the gf_m2ts_decode_ait function. This flaw allows an out-of-bounds write, which can be triggered remotely. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact. A patch identified by commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 is available and should be applied to remediate the issue.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in the function gf_m2ts_decode_ait within the AIT Parser component of GPAC versions up to 26.07.0. It allows an attacker to cause an out-of-bounds write, potentially leading to integrity and availability impacts. The vulnerability can be exploited remotely and requires user interaction. A patch identified by commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 has been made available to fix this issue.
Potential Impact
Successful exploitation of this vulnerability can lead to an out-of-bounds write, which may result in partial loss of integrity and availability of the affected system. The attack can be launched remotely and requires user interaction. The confidentiality impact is low, while integrity and availability impacts are also low to medium.
Mitigation Recommendations
A patch has been created and is advised to be applied to resolve this issue. Users should apply the patch identified by commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 to mitigate the vulnerability. No additional vendor advisory was provided, so patch status beyond this patch reference is not confirmed. Check the vendor's official resources for the latest remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-xg2v-p5jc-x9xf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-109827"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acea92f2cdf04f656b679e0
Added to database: 10/13/2026, 21:57:03 UTC
Last enriched: 10/13/2026, 22:04:18 UTC
Last updated: 10/14/2026, 04:48:08 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.