CVE-2026-1418: GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write
A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gftextimportsrtbifs of the file src/scenemanager/texttobifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1418?
CVE-2026-1418 has a high severity rating due to the potential for an out-of-bounds write which can lead to arbitrary code execution.
How do I fix CVE-2026-1418?
To mitigate CVE-2026-1418, update GPAC to version 2.4.1 or later where the vulnerability is addressed.
Which versions of GPAC are affected by CVE-2026-1418?
CVE-2026-1418 affects all versions of GPAC up to and including 2.4.0.
What component is vulnerable in CVE-2026-1418?
The vulnerability in CVE-2026-1418 exists in the SRT Subtitle Import component of GPAC.
What type of vulnerability is CVE-2026-1418?
CVE-2026-1418 is classified as an out-of-bounds write vulnerability.