CVE-2026-71613: Buffer Overflow

Published Sep 9, 2026

Updated

Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdecprocess() function. Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859.

Affected Software

1 affected component

Gpac GPAC=c2dee3aff638cd96f9617ac5b17dc2868cd90ef3, =9a253a07fd3f6b48022bba74302bf39388dda859

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade gpac to a version that resolves this vulnerability.
Fixed in 9a253a07fd3f6b48022bba74302bf39388dda859

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What input would an attacker need to control to exploit this issue?

The issue is reachable through the j2kdec_process() function, indicating that exploitation requires attacker-controlled input processed by the JPEG 2000 decoder path. The provided data does not establish whether this can be reached remotely in a particular deployment.

Which builds are affected or fixed?

The vulnerability is fixed by commit 9a253a07fd3f6b48022bba74302bf39388dda859. The affected code is identified as commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3; no release version range is provided.