CVE-2026-71614: Gpac GPAC vulnerability

Published Sep 9, 2026

Updated

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/mediatools/dvbmpe.c, descriptorTimeslicefecidentifier() and gfm2tsipdatagramreader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.

Affected Software

1 affected component

Gpac GPAC

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GPAC to a version that resolves this vulnerability.
Fixed in 0e4093392e1f847c90d20e031e893cd942fef938

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which GPAC source revisions are identified as vulnerable and fixed?

The issue is identified in source revision c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. The fix is in commit 0e4093392e1f847c90d20e031e893cd942fef938; no release version range is provided.

How can I check whether my build includes the remediation?

Compare the source history used for the build with commit 0e4093392e1f847c90d20e031e893cd942fef938. A build that includes that commit contains the stated fix.