CVE-2026-8124

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-770

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-812409.8Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unaCVE-2026-81256.3A vulnerability was detected in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file sendMessage.php. TCVE-2026-81267.3A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This maCVE-2026-812657.5IBM Langflow OSS 1.0.0 through 1.11.5.CVE-2026-812675.4A malicious webpage could stall a popup's cross-origin navigation after commit, causing the address bar to display the destination origin whCVE-2026-812688.1IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to iCVE-2026-812695.3Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0CVE-2026-81276.3A vulnerability has been found in eladmin up to 2.7. Impacted is the function checkLevel of the file /rest/UserController.java of the componCVE-2026-812707.5Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended CVE-2026-812718.8Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.CVE-2026-812724.9Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.CVE-2026-812738.1Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.