{"schema":"threatline.record/2","record":{"id":"CVE-2026-109827","aliases":[],"summary":"GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write","details":"A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.","categories":["Unclassified"],"product":"GPAC","vendor":"n/a","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109827","source_modified_at":"2026-10-15T15:11:47.862Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"GPAC","vendor":"n/a","versions":[{"version":"26.07","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00293,"percentile":0.20723,"score_date":"2026-10-23"},"published_at":"2026-10-13T16:45:16.965Z","modified_at":"2026-10-15T15:11:47.862Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109827","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T15:11:47.862Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109827","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://vuldb.com/vuln/417465","tags":["vdb-entry","technical-description"]},{"source":"CVE List","url":"https://vuldb.com/vuln/417465/cti","tags":["signature","permissions-required"]},{"source":"CVE List","url":"https://vuldb.com/cve/CVE-2026-109827","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://vuldb.com/submit/1001680","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/gpac/gpac/issues/3930","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/gpac/gpac/pull/3932","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://www.mediafire.com/file/zbpfhkgaf18cntf/poc_gpac_g1.zip/file","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/gpac/gpac/commit/6d2c21a1a688abb20d0111b608db3b6f44d348f4","tags":["patch"]},{"source":"CVE List","url":"https://github.com/gpac/gpac/","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-15T14:52:15.160123Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T15:11:47.862Z","content_hash":"b82db25c8f711fc459ffbf922b7ec28c5db685aea4f4a1920a3ce7c62b0fd139"}}