CVE-2026-13523: GPAC ISOBMFF base_encoding.c data amplification
A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/baseencoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC ISOBMFF base_encoding.c (ISOBMFF Parser)to a version that resolves this vulnerability.Fixed in 26.02.0Patch 297f2d8d1f493d8b241330533cd47f7da758aeb3 - Compensating control
Because the attack needs to be launched locally, restrict local execution/launch of GPAC processes handling untrusted ISOBMFF files to trusted users/systems (e.g., via OS/user permissions and/or host isolation).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13523?
The severity of CVE-2026-13523 is rated low at 3.3.
How can I mitigate CVE-2026-13523?
To mitigate CVE-2026-13523, ensure you are using an updated version of GPAC that addresses this vulnerability.
What impact does CVE-2026-13523 have?
CVE-2026-13523 can lead to data amplification through manipulated compressed data, affecting resource usage.
Who is affected by CVE-2026-13523?
CVE-2026-13523 affects users of GPAC versions up to 26.02.0 with access to the ISOBMFF Parser.
Is CVE-2026-13523 exploitable remotely?
CVE-2026-13523 requires local access to exploit, limiting its potential impact.