CVE-2026-92475

A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/utils/downloader.c. This manipulation of the argument Content-Range causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version abi-16.26 will fix this issue. Patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84. It is recommended to upgrade the affected component.

• CWE-119
• CWE-125

• https://github.com/gpac/gpac/
• https://github.com/gpac/gpac/commit/c74a3065038ede35c1c7b75fa493a69ef6bcdb84
• https://github.com/gpac/gpac/issues/3859
• https://github.com/gpac/gpac/releases/tag/abi-16.26
• https://vuldb.com/cve/CVE-2026-92475
• https://vuldb.com/submit/941761
• https://vuldb.com/vuln/405734
• https://vuldb.com/vuln/405734/cti

Published

Sep 16, 2026

Last Modified

Sep 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92468zlt2000 microservices-platform through 6.0.0 contains an aut…6.5
• CVE-2026-92469zlt2000 microservices-platform through 6.0.0 contains an aut…8.1
• CVE-2026-9247Insufficient logging in the entry export feature in Devoluti…2.4
• CVE-2026-92472A vulnerability was determined in GPAC 26.08-DEV. The affect…3.3
• CVE-2026-92473A vulnerability was identified in GPAC 26.08-DEV. The impact…3.3
• CVE-2026-92474A security flaw has been discovered in GPAC 26.08-DEV. This …3.3
• CVE-2026-92476In the Linux kernel, the following vulnerability has been re…
• CVE-2026-92477In the Linux kernel, the following vulnerability has been re…
• CVE-2026-92478In the Linux kernel, the following vulnerability has been re…
• CVE-2026-92479In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9248Authorization bypass in the entry duplication feature in Dev…2.6
• CVE-2026-92480In the Linux kernel, the following vulnerability has been re…