CVE-2026-13523
GPAC ISOBMFF base_encoding.c data amplification
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."
| CWE | CWE-409 CWE-404 |
| Vendor | n/a |
| Product | gpac |
| Published | Jun 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a gpac
Be the first to know when new low vulnerabilities affecting n/a gpac are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / GPAC
26.02
References
vuldb.com: https://vuldb.com/vuln/374531 vuldb.com: https://vuldb.com/vuln/374531/cti vuldb.com: https://vuldb.com/cve/CVE-2026-13523 vuldb.com: https://vuldb.com/submit/840159 github.com: https://github.com/gpac/gpac/issues/3588 github.com: https://github.com/gpac/gpac/pull/3589 github.com: https://github.com/gpac/gpac/commit/297f2d8d1f493d8b241330533cd47f7da758aeb3 github.com: https://github.com/gpac/gpac/
Credits
🔍 Fantasy (VulDB User) VulDB CNA Team