CVE-2026-15185: GPAC MP4Box Out-of-Bounds Read in VOBSUB Processing

Technical summary

CVE-2026-15185 is an out-of-bounds read vulnerability in GPAC 26.03-DEV's vobsub_read_idx function located in /src/media_tools/vobsub.c. The flaw exists in the MP4Box component when processing the num_langs parameter from VOBSUB subtitle index files. Improper bounds checking allows attackers to read memory beyond the intended buffer, falling under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read). The CVSS v3.1 score is 3.3 (LOW) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, indicating local attack vector, low complexity, and impact limited to availability.

Business impact

For organizations using GPAC's MP4Box for media processing pipelines—particularly those handling untrusted or user-supplied subtitle files—this vulnerability poses a denial-of-service risk. A malicious VOBSUB file could crash batch media conversion jobs, interrupt automated transcoding workflows, or disrupt video processing services. The low severity classification reflects that exploitation requires local system access and does not enable unauthorized data access or code execution. However, in environments processing media from external sources, this remains a reliability concern.

Affected systems

The vulnerability specifically affects GPAC version 26.03-DEV. Other versions and the stable release lineage have not been indicated as affected in the provided advisory data. Organizations should verify whether their deployments run this development version or if they have upgraded to patched releases. GPAC is primarily used in media processing, transcoding, and streaming scenarios where MP4Box functionality is leveraged for file manipulation.

Exploitability

Exploitation requires local system access and involves crafting a malicious VOBSUB subtitle file with a specially manipulated num_langs value. While public disclosure has occurred and exploit code may be available, the attack surface remains confined to local threat actors who can supply or modify input files processed by MP4Box. No network-based exploitation vector exists. The low attack complexity suggests the malicious file format is straightforward to construct, making this a viable denial-of-service vector for local attackers.

Remediation

Apply the security patch identified as commit 532097084729a936bcdf6a27c41003f3bd7dc3ff, which addressed this issue. The advisory notes that two separate commits were applied to fully resolve the flaw, so verify that all related patches are deployed when updating. Check the GPAC project repository or your vendor's advisory for the corresponding stable release version that includes these fixes, as the vulnerability was identified in a development version (26.03-DEV).

Patch guidance

Obtain and apply patch commit 532097084729a936bcdf6a27c41003f3bd7dc3ff from the GPAC repository. Since two different commits were needed to fully resolve the issue, consult the GPAC project's commit history or release notes to confirm all related fixes are included in your target version. If running 26.03-DEV, migrate to the next stable release or apply the development branch patches directly. Test media processing workflows after patching to ensure no regressions.

Detection guidance

Monitor for applications (particularly MP4Box) processing VOBSUB subtitle files from untrusted sources. Log and alert on crashes or abnormal termination of media processing services, especially if correlated with subtitle file ingestion. Review media processing pipelines to identify where external subtitle files enter the system. Consider implementing file validation or sandboxing for user-supplied subtitle content before processing. Network-based detection is limited due to the local-only attack vector; focus on endpoint and process monitoring.

Why prioritize this

Despite its LOW CVSS score, this vulnerability should be addressed promptly in media processing environments. The public disclosure and availability of exploit code elevate practical risk, and the denial-of-service impact can disrupt business-critical workflows. However, organizations without GPAC deployments or those not processing external VOBSUB files can deprioritize. Urgency should be calibrated to the presence of untrusted subtitle file sources in your infrastructure.

Risk score, explained

The CVSS v3.1 score of 3.3 reflects the vulnerability's low impact profile: local-only attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and limited to availability impact (A:L) with no confidentiality or integrity compromise. The score appropriately captures that this is a denial-of-service risk with restricted exploitability, not a critical remote code execution or data breach threat.

Frequently asked questions