CVE-2026-109827: GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gfm2tsdecodeait of the file src/mediatools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPACto a version that resolves this vulnerability.Patch 6d2c21a1a688abb20d0111b608db3b6f44d348f4
Event History
Frequently Asked Questions
Which deployments are affected?
GPAC installations running versions up to and including 26.07.0 are affected. The vulnerable code is in the AIT Parser component.
What does exploitation require?
The issue can be attacked remotely with low attack complexity and no privileges required. The supplied severity vector indicates that user interaction is required.
Is exploit code available, and what is the recommended remediation?
The exploit has been publicly disclosed and may be used. Apply the patch identified as 6d2c21a1a688abb20d0111b608db3b6f44d348f4.