CVE-2026-7135: GPAC MP4Box box_code_base.c elng_box_read out-of-bounds
A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elngboxread of the file src/isomedia/boxcodebase.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is named cf6ac48c972eaaee2af270adc3f36615325deb3e. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch cf6ac48c972eaaee2af270adc3f36615325deb3e - Compensating control
Approach the attack locally (limit exposure so MP4Box functionality handling box_code_base.c/elng_box_read is only reachable from the local context), since the attack needs to be approached locally.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7135?
CVE-2026-7135 is classified as a security vulnerability that can lead to out-of-bounds access, potentially allowing for remote code execution.
How do I fix CVE-2026-7135?
To remediate CVE-2026-7135, you should upgrade to the latest version of GPAC MP4Box beyond version 26.03-DEV-rev105-g8f39a1eb3-master.
What are the potential impacts of CVE-2026-7135?
The potential impacts of CVE-2026-7135 include unauthorized access to user data, execution of arbitrary code, and system crashes.
Which versions of GPAC MP4Box are affected by CVE-2026-7135?
CVE-2026-7135 affects GPAC MP4Box versions up to and including 26.03-DEV-rev105-g8f39a1eb3-master.
Is CVE-2026-7135 exploitable remotely?
Yes, CVE-2026-7135 can be exploited remotely if attackers manipulate the input data processed by the affected elng_box_read function.