Description
A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."
References (8)
Core 8
Core References
Vdb Entry vdb-entry
VDB-374531 | GPAC ISOBMFF base_encoding.c data amplification
https://vuldb.com/vuln/374531
Signature, Permissions Required signature
permissions-required
VDB-374531 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/374531/cti
Third Party Advisory third-party-advisory
CVE-2026-13523 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-13523
Product product
https://github.com/gpac/gpac/
Third Party Advisory third-party-advisory
Submit #840159 | GPAC <= 26.02.0 Uncontrolled Resource Consumption
https://vuldb.com/submit/840159
Exploit exploit
issue-tracking
https://github.com/gpac/gpac/issues/3588
Patch issue-tracking
patch
https://github.com/gpac/gpac/pull/3589
Scores
CVSS v3
3.3
EPSS
0.0011
EPSS Percentile
1.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-404
CWE-409
Status
published
Products (1)
None/GPAC
26.02
Published
Jun 29, 2026
Tracked Since
Jun 29, 2026