CVE-2026-1418

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1418", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-25T09:58:18.674Z", "datePublished": "2026-01-26T04:02:06.877Z", "dateUpdated": "2026-02-23T08:56:25.925Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:56:25.925Z"}, "title": "GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "GPAC", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1", "status": "affected"}, {"version": "2.2", "status": "affected"}, {"version": "2.3", "status": "affected"}, {"version": "2.4.0", "status": "affected"}], "cpes": ["cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"], "modules": ["SRT Subtitle Import"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-01-25T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-25T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-29T02:01:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Kery Qi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.342807", "name": "VDB-342807 | GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342807", "name": "VDB-342807 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736544", "name": "Submit #736544 | gpac v2.4.0 Out-of-bounds Write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/gpac/gpac/issues/3425", "tags": ["issue-tracking"]}, {"url": "https://github.com/gpac/gpac/issues/3425#issue-3801961068", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/enocknt/gpac/commit/10c73b82cf0e367383d091db38566a0e4fe71772", "tags": ["patch"]}, {"url": "https://github.com/gpac/gpac/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T15:15:51.013280Z", "id": "CVE-2026-1418", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:18:59.430Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1418", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T15:15:51.013280Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T15:16:59.469Z"}}], "cna": {"tags": ["x_open-source"], "title": "GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write", "credits": [{"lang": "en", "type": "reporter", "value": "Kery Qi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["SRT Subtitle Import"], "product": "GPAC", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4.0"}]}], "timeline": [{"lang": "en", "time": "2026-01-25T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-25T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-29T02:01:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.342807", "name": "VDB-342807 | GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.342807", "name": "VDB-342807 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.736544", "name": "Submit #736544 | gpac v2.4.0 Out-of-bounds Write", "tags": ["third-party-advisory"]}, {"url": "https://github.com/gpac/gpac/issues/3425", "tags": ["issue-tracking"]}, {"url": "https://github.com/gpac/gpac/issues/3425#issue-3801961068", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/enocknt/gpac/commit/10c73b82cf0e367383d091db38566a0e4fe71772", "tags": ["patch"]}, {"url": "https://github.com/gpac/gpac/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:56:25.925Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1418", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:56:25.925Z", "dateReserved": "2026-01-25T09:58:18.674Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-26T04:02:06.877Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"], "modules": ["SRT Subtitle Import"], "product": "GPAC", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4.0"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*", "matchCriteriaId": "3569968C-C15E-4091-B538-8B212A2F16CC", "versionEndIncluding": "2.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en GPAC hasta 2.4.0. Esto afecta la funci\u00f3n gf_text_import_srt_bifs del archivo src/scene_manager/text_to_bifs.c del componente SRT Subtitle Import. Dicha manipulaci\u00f3n conduce a una escritura fuera de l\u00edmites. El ataque necesita ser realizado localmente. El exploit ha sido divulgado p\u00fablicamente y puede ser usado. El nombre del parche es 10c73b82cf0e367383d091db38566a0e4fe71772. Es una buena pr\u00e1ctica aplicar un parche para resolver este problema."}], "id": "CVE-2026-1418", "lastModified": "2026-06-17T10:15:44.877", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1418", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T15:15:51.013280Z", "version": "2.0.3"}}]}, "published": "2026-01-26T04:16:10.360", "references": [{"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/enocknt/gpac/commit/10c73b82cf0e367383d091db38566a0e4fe71772"}, {"source": "cna@vuldb.com", "url": "https://github.com/gpac/gpac/"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/gpac/gpac/issues/3425"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/gpac/gpac/issues/3425#issue-3801961068"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.342807"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.342807"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.736544"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-787"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:46:08.685726+00:00", "value": {"mitigation_remediation": ["Upgrade GPAC to a version newer than 2.4.0, such as 2.4.1 or later, where the out-of-bounds write bug has been fixed.", "If an upgrade is not immediately possible, stop processing or loading SRT subtitle files until the patch is applied, or restrict SRT import to trusted, non-user supplied locations.", "Apply the specific patch commit 10c73b82cf0e367383d091db38566a0e4fe71772 to the source code and rebuild the GPAC binaries, ensuring the bounds check is restored."], "summary": {"action": "Apply Patch", "impact": "Local Code Execution"}, "threat_synthesis": {"affected_systems": "GPAC, versions up to and including 2.4.0 of the GPAC multimedia framework, including any applications that embed GPAC\u2019s subtitle processing component. The issue is tied to the SRT subtitle import feature of the core GPAC library. System administrators should be aware that any binaries compiled against these releases are vulnerable.", "description_and_impact": "A critical vulnerability exists in the GPAC multimedia framework's SRT subtitle import routine, specifically the gf_text_import_srt_bifs function in src/scene_manager/text_to_bifs.c. The bug facilitates an out\u2011of\u2011bounds write due to improper bounds checking during subtitle data conversion, classified as CWE\u2011119 and CWE\u2011787. An attacker with local access can supply a crafted SRT file that triggers the memory corruption, potentially allowing arbitrary code execution or privilege escalation on the host system. The impact is limited to systems running an affected GPAC build and requiring local file manipulation.", "risk_and_exploitability": "According to the CVSS scoring, this flaw scores 4.8, indicating moderate severity. The EPSS value is below 1\u202f%, suggesting a low likelihood of widespread exploitation as of the last assessment. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires local access to the GPAC installation and the ability to trigger subtitle import with a malicious SRT file. No remote attack vector is documented, so the risk is confined to environments where untrusted SRT input can be processed by a local instance of GPAC."}}}}, "created": "2026-01-26T11:47:58.888230+00:00", "updated": "2026-04-18T03:00:10.307830+00:00", "vendors": ["gpac", "gpac$PRODUCT$gpac"]}