CVE-2026-33144

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)

5.8 Medium

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: High

Exploit likelihood

0.18%Up 0.2 points since Mar 21, 2026

What each source reports

CVE List Score used 5.8

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)

Record: CVE-2026-33144
CVSS 3.1: 5.8 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-13782 5.8

Record: EUVD-2026-13782
CVSS 3.1: 5.8 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated: 2026-11-02

NVD 5.8

Record: CVE-2026-33144
CVSS 3.1: 5.8 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV 5.8

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)

Record: CVE-2026-33144
CVSS 3.1: 5.8 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-33144 7.8

Record: DEBIAN-CVE-2026-33144
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-33144 5.8

Record: UBUNTU-CVE-2026-33144
CVSS 3.1: 5.8 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

gpac

Affected packages

Affected packages
Package	Affected	Fixed
`gpac` Debian:11	All versions, plus listed versions 1.0.1+dfsg1-41.0.1+dfsg1-4+deb11u11.0.1+dfsg1-4+deb11u21.0.1+dfsg1-4+deb11u31.0.1+dfsg1-5 Show 8 moreShow less 2.0.0+dfsg1-12.0.0+dfsg1-22.0.0+dfsg1-42.2.1+dfsg1-12.2.1+dfsg1-22.2.1+dfsg1-32.2.1+dfsg1-3.12.2.1+dfsg1-3.1~exp1	None known
`gpac` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 0.5.0+svn4288~dfsg1-1ubuntu10.5.0+svn4288~dfsg1-40.5.0+svn4288~dfsg1-4ubuntu10.5.0+svn4288~dfsg1-4ubuntu1+esm10.5.0+svn4288~dfsg1-4ubuntu1+esm2	None known
`gpac` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-1build10.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.10.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2	None known
`gpac` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-30.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.10.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1	None known
`gpac` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-4ubuntu10.5.2-426-gc5ad4e4+dfsg5-50.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2	None known
`gpac` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1.0.1+dfsg1-41.0.1+dfsg1-52.0.0+dfsg1-22.0.0+dfsg1-2ubuntu0.1~esm2	None known
`gpac` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 2.2.1+dfsg1-32.2.1+dfsg1-3.12.2.1+dfsg1-3.1build12.2.1+dfsg1-3.1build22.2.1+dfsg1-3.1ubuntu0.1~esm2	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33144 is a medium vulnerability (CVSS 5.8) in Gpac, published March 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.