CVE-2026-15185CWE-119CWE-125

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds

Medium · published July 9, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
4.8
In the wild
Unconfirmed
What it is

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsub_read_idx of the file /src/media_tools/vobsub.c of the component MP4Box. Executing a manipulation of the argument num_langs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00160 · 4.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-125 · Out-of-bounds Read
Published
2026-07-09T12:30Z
EPSS history
Timeline
  • 09 JUL 12:30Z
    GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
    cvelistv5