CVE-2018-20760
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a...
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
CVE-2018-20760- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
CVE-2018-20760- Updated
- 2026-11-02
EUVDEUVD-2018-13303 No score
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
EUVD-2018-13303- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cq29-4q3m-c59v
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a...
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
GHSA-cq29-4q3m-c59v- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
CVE-2018-20760- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-20760
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
DEBIAN-CVE-2018-20760- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-20760
In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled.
- Record
UBUNTU-CVE-2018-20760- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0146 No score
Updated gpac packages fix security vulnerability
It was discovered that the GPAC MP4Box utility incorrectly handled certain memory operations. If an user or automated system were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause MP4Box to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2018-7752, CVE-2018-13005, CVE-2018-13006, CVE-2018-20760, CVE-2018-20761, CVE-2018-20762, CVE-2018-20763, CVE-2018-1000100).
- Record
MGASA-2019-0146- Updated
- 2026-11-02
OSVUSN-3926-1 No score
gpac vulnerabilities
It was discovered that the GPAC MP4Box utility incorrectly handled certain memory operations. If an user or automated system were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause MP4Box to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3926-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gpacDebian:11 |
before 0.5.2-426-gc5ad4e4+dfsg5-4.1 | 0.5.2-426-gc5ad4e4+dfsg5-4.1 |
gpacDebian:8 |
before 0.5.0+svn5324~dfsg1-1+deb8u2, plus listed versions 0.5.0+svn5324~dfsg1-10.5.0+svn5324~dfsg1-1+deb8u1 |
0.5.0+svn5324~dfsg1-1+deb8u2 |
gpacMageia:6 |
before 0.6.1-4.1.mga6.tainted | 0.6.1-4.1.mga6.tainted |
gpacUbuntu:Pro:14.04:LTS |
before 0.5.0+svn4288~dfsg1-4ubuntu1+esm1, plus listed versions 0.5.0+svn4288~dfsg1-1ubuntu10.5.0+svn4288~dfsg1-40.5.0+svn4288~dfsg1-4ubuntu1 |
0.5.0+svn4288~dfsg1-4ubuntu1+esm1 |
gpacUbuntu:16.04:LTS |
before 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-1build1 |
0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1 |
gpacUbuntu:18.04:LTS |
before 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-3 |
0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-20760 is a high vulnerability (CVSS 7.8) in Gpac, published February 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in gpac 0.5.2-426-gc5ad4e4+dfsg5-4.1.
References
lists.debian.org/debian-lts-announce/2019/02/msg00040.html
github.com/gpac/gpac/commit/4c1360818fc8948e9307059fba4dc47ba8ad255d
usn.ubuntu.com/3926-1
nvd.nist.gov/vuln/detail/CVE-2018-20760
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2018-20760
advisories.mageia.org/MGASA-2019-0146.html
bugs.mageia.org/show_bug.cgi?id=24601
ubuntu.com/security/CVE-2018-20760
cve.org/CVERecord?id=CVE-2018-20760