Skip to main content
VulnerabilityPublished Updated

hevc_ref_pic_lists_modification · Gpac: Heap-buffer-overflow

Affects gpacSource GCVE Database

0
Severity
High

Rated by Threat Radar

Data as of 12 Sep 2026, 18:17 UTC

What to do

Affected software

ProductAffectedFixed in
OSS-Fuzzgpacpkg:generic/gpacOther threatsAffected
  • >=21cf0d2d4a0d6e5d14ffaa8472c9157f1333d379
  • =testtag0.1
  • =abi-12
  • =abi-12.16
  • =abi-12.17
  • =abi-12.18
  • =abi-12.19
  • =abi-12.20
  • =abi-12.21
  • =abi-12.22
  • =abi-12.23
  • =abi-12.24
  • =abi-12.25
  • =abi-12.26
  • =abi-12.27
  • =abi-13
  • =abi-13.0
  • =abi-14
  • =abi-14.0
  • =abi-15
  • =abi-15.0
  • =abi-15.1
  • =abi-15.2
  • =abi-16
  • =abi-16.2
  • =abi-16.3
  • =abi-16.4
  • =abi-16.5
  • =v26.02.0
  • =abi-16.6
  • =abi-16.7
  • =abi-16.8
  • =abi-16.9
  • =abi-16.10
  • =abi-16.11
  • =abi-16.12
  • =abi-16.13
  • =abi-16.14
  • =abi-16.15
  • =abi-16.16
  • =abi-16.17
  • =abi-16.18
  • =abi-16.19
  • =abi-16.20
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Until a fix is available, avoid processing untrusted HEVC streams with affected gpac versions.

Description

A heap-buffer-overflow vulnerability has been identified in the gpac software within the hevc_ref_pic_lists_modification function. This issue was reported by OSS-Fuzz and involves a write operation that exceeds the allocated heap buffer. The crash occurs during HEVC NAL unit parsing and inspection.

References

Community reviews

Loading reviews…