CVE-2025-15668: Heap-based Buffer Overflow in GPAC
CVE-2025-15668 is a medium severity heap-based buffer overflow vulnerability in the GPAC project's MP4Box component, specifically in the sgpd_del_entry function of src/isomedia/box_code_base.c. It requires local access and low privileges to exploit. A patch identified by commit f29f955f2a3b5e8e507caad3e52319f961bf37bf is available to address the issue. Exploit code is publicly available, but no known exploits in the wild have been reported.
AI Analysis
Technical Summary
This vulnerability in GPAC up to commit b40ce70f5 involves improper handling of argument data in the sgpd_del_entry function, leading to a heap-based buffer overflow. The issue requires local attacker access with low privileges and no user interaction. The vulnerability has a CVSS 4.8 (medium) score and the patch is available as commit f29f955f2a3b5e8e507caad3e52319f961bf. No official vendor advisory or remediation level is provided, but the patch commit indicates a fix exists.
Potential Impact
Successful exploitation can cause a heap-based buffer overflow, potentially leading to application crashes or arbitrary code execution under the privileges of the local user. Since local access is required and privileges are low, the impact is limited to local users who can run the vulnerable software.
Mitigation Recommendations
Apply the patch identified by commit f29f955f2a3b5e8e507caad3e52319f961bf to correct the heap-based buffer overflow. Since no official vendor advisory is provided, verify the patch from the GPAC source repository. Restrict local access to trusted users to reduce risk until patched.
CVE-2025-15668: Heap-based Buffer Overflow in GPAC
Description
CVE-2025-15668 is a medium severity heap-based buffer overflow vulnerability in the GPAC project's MP4Box component, specifically in the sgpd_del_entry function of src/isomedia/box_code_base.c. It requires local access and low privileges to exploit. A patch identified by commit f29f955f2a3b5e8e507caad3e52319f961bf37bf is available to address the issue. Exploit code is publicly available, but no known exploits in the wild have been reported.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in GPAC up to commit b40ce70f5 involves improper handling of argument data in the sgpd_del_entry function, leading to a heap-based buffer overflow. The issue requires local attacker access with low privileges and no user interaction. The vulnerability has a CVSS 4.8 (medium) score and the patch is available as commit f29f955f2a3b5e8e507caad3e52319f961bf. No official vendor advisory or remediation level is provided, but the patch commit indicates a fix exists.
Potential Impact
Successful exploitation can cause a heap-based buffer overflow, potentially leading to application crashes or arbitrary code execution under the privileges of the local user. Since local access is required and privileges are low, the impact is limited to local users who can run the vulnerable software.
Mitigation Recommendations
Apply the patch identified by commit f29f955f2a3b5e8e507caad3e52319f961bf to correct the heap-based buffer overflow. Since no official vendor advisory is provided, verify the patch from the GPAC source repository. Restrict local access to trusted users to reduce risk until patched.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-04T05:16:20.854Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b96ef27e9c797196fcc7c
Added to database: 07/06/2026, 11:52:15 UTC
Last enriched: 07/06/2026, 12:06:26 UTC
Last updated: 07/06/2026, 12:24:37 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.