CVE-2026-15185: GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in 26.03-DEVPatch 532097084729a936bcdf6a27c41003f3bd7dc3ff - Compensating control
Since the attack needs to be launched locally and the exploit is publicly disclosed, restrict local execution/access to the affected GPAC MP4Box MP4Box component (e.g., limit who/what can run MP4Box/MP4Box MP4Box MP4Box vobsub.c locally).
- Compensating control
Because exploitation may be utilized, treat any local access to MP4Box handling of vobsub arguments as untrusted input; limit local users/services that can invoke MP4Box on attacker-controlled media files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15185?
CVE-2026-15185 has a severity rating of low, with a score of 3.3.
What type of vulnerability is CVE-2026-15185?
CVE-2026-15185 is classified as a buffer overflow vulnerability.
How do I fix CVE-2026-15185?
To mitigate CVE-2026-15185, update to the latest version of GPAC MP4Box where the vulnerability has been addressed.
What component is affected by CVE-2026-15185?
CVE-2026-15185 affects the vobsub_read_idx function in the vobsub.c file of the GPAC MP4Box component.
How can CVE-2026-15185 be exploited?
CVE-2026-15185 can be exploited locally by manipulating the num_langs argument, leading to an out-of-bounds read.