CVE-2026-103227: GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version abi-16.26 can resolve this issue. Patch name: 4c8e26f278ff63eec57968f7bc696f604bb0cffd. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC DASH Clientto a version that resolves this vulnerability.Fixed in abi-16.26Patch 4c8e26f278ff63eec57968f7bc696f604bb0cffd
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The issue is remotely exploitable with low attack complexity and requires no privileges, but it requires user interaction. Exploitation involves manipulating input processed by the DASH Client's URL-resolution function.
Which deployments should be prioritized for remediation?
Prioritize GPAC deployments that use the DASH Client component and are running versions up to 26.07.0. The affected code is in src/media_tools/dash_client.c, specifically gf_dash_resolve_url.
What version or patch addresses the issue?
Upgrade the affected component to version abi-16.26. The referenced patch is 4c8e26f278ff63eec57968f7bc696f604bb0cffd.