VulnerabilityPublished 18 Jul 2024Updated 31 Aug 2026

Gpac: Index-out-of-bounds

Affects gpacSource GCVE Database

Severity

Medium

Rated by Threat Radar

Data as of 31 Aug 2026, 15:41 UTC

What to do

Affected software

Product	Affected	Fixed in
OSS-Fuzzgpac`pkg:generic/gpac`Other threats	Affected abi-12 – v26.02.0 >=99a7952e91938f8c0d16f2235b912de1fed6c1f8 42 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until a fix is available, avoid processing untrusted VVC video streams with affected versions of gpac to mitigate risk.

Description

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392 ``` Crash type: Index-out-of-bounds Crash state: gf_vvc_parse_nalu_bs gf_inspect_dump_nalu_internal inspect_process ```

Impact

The vulnerability causes an application crash due to an index-out-of-bounds error during video data parsing. This may lead to denial of service or application instability when processing crafted VVC streams. There is no evidence of code execution or data corruption beyond the crash. No known exploitation in the wild has been reported.

Summary

The vulnerability is an index-out-of-bounds error triggered in the gpac multimedia framework's function gf_vvc_parse_nalu_bs, which parses VVC (Versatile Video Coding) NAL units. This leads to a crash state identified by OSS-Fuzz, specifically during the inspection and dumping of NAL units. The affected versions include gpac 26.02.0 and versions from commit 99a7952e91938f8c0d16f2235b912de1fed6c1f8 onward.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=70392 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 00:29 UTC

Technical details

References

Community reviews

Related threats