A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read.
It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68.
The affected component should be upgraded.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:gpac
References 8
https://vuldb.com/vuln/406641
VDB-406641 | GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds
https://vuldb.com/vuln/406641/cti
VDB-406641 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-93331
CVE-2026-93331 | CVE Analysis and Report
https://vuldb.com/submit/942834
Submit #942834 | GPAC 26.08-DEV Memory Corruption
https://github.com/gpac/gpac/issues/3868
NVD
https://github.com/gpac/gpac/commit/6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68
NVD
https://github.com/gpac/gpac/releases/tag/abi-16.26
NVD
https://github.com/gpac/gpac/
NVD