CVE-2025-15668

LowCVSS 3.3/10Last modified Oct 12, 2026

Description

A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-119CWE-122

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-156694.8The Bit Form WordPress plugin before 3.1.4 does not sanitise one of its conversational-form display settings before rendering it on the pubCVE-2025-156715.4The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session idenCVE-2025-156728.1The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowCVE-2025-156734.9The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CVE-2025-156742.7The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from reading globally pasCVE-2025-156754.8The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in aCVE-2025-156773.5The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admiCVE-2025-156786.1The Nexter Blocks WordPress plugin before 5.0.2 does not sanitize uploaded SVG files and allows SVG uploads for any user able to upload filCVE-2025-156797.3Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequanCVE-2025-15688.8Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered GCVE-2025-156802.4TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate aCVE-2025-156819.2TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device,
CVE-2025-15668: Low severity, CVSS 3.3 | Vulnix