CVE-2018-13005
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base...
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
CVE-2018-13005- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
CVE-2018-13005- Updated
- 2026-11-02
EUVDEUVD-2018-4955 No score
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
EUVD-2018-4955- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5x3-q74r-h7hq
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base...
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
GHSA-r5x3-q74r-h7hq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
CVE-2018-13005- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-13005
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
DEBIAN-CVE-2018-13005- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-13005
An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read.
- Record
UBUNTU-CVE-2018-13005- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0146 No score
Updated gpac packages fix security vulnerability
It was discovered that the GPAC MP4Box utility incorrectly handled certain memory operations. If an user or automated system were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause MP4Box to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2018-7752, CVE-2018-13005, CVE-2018-13006, CVE-2018-20760, CVE-2018-20761, CVE-2018-20762, CVE-2018-20763, CVE-2018-1000100).
- Record
MGASA-2019-0146- Updated
- 2026-11-02
OSVUSN-3926-1 No score
gpac vulnerabilities
It was discovered that the GPAC MP4Box utility incorrectly handled certain memory operations. If an user or automated system were tricked into opening a specially crafted MP4 file, a remote attacker could use this issue to cause MP4Box to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-3926-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gpacDebian:11 |
before 0.5.2-426-gc5ad4e4+dfsg5-4.1 | 0.5.2-426-gc5ad4e4+dfsg5-4.1 |
gpacDebian:8 From an advisory covering 2 CVEs |
before 0.5.0+svn5324~dfsg1-1+deb8u1, plus listed versions 0.5.0+svn5324~dfsg1-1 |
0.5.0+svn5324~dfsg1-1+deb8u1 |
gpacMageia:6 From an advisory covering 8 CVEs |
before 0.6.1-4.1.mga6.tainted | 0.6.1-4.1.mga6.tainted |
gpacUbuntu:Pro:14.04:LTS |
before 0.5.0+svn4288~dfsg1-4ubuntu1+esm1, plus listed versions 0.5.0+svn4288~dfsg1-1ubuntu10.5.0+svn4288~dfsg1-40.5.0+svn4288~dfsg1-4ubuntu1 |
0.5.0+svn4288~dfsg1-4ubuntu1+esm1 |
gpacUbuntu:16.04:LTS |
before 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-1build1 |
0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1 |
gpacUbuntu:18.04:LTS |
before 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-3 |
0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1 |
gpacUbuntu:16.04:LTS From an advisory covering 8 CVEs |
before 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-1build1 |
0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1 |
gpacUbuntu:18.04:LTS From an advisory covering 8 CVEs |
before 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1, plus listed versions 0.5.2-426-gc5ad4e4+dfsg5-3 |
0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-13005 is a critical vulnerability (CVSS 9.8) in Gpac, published June 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.50%, the 84th percentile. Fixed in gpac 0.5.2-426-gc5ad4e4+dfsg5-4.1.
References
lists.debian.org/debian-lts-announce/2018/07/msg00024.html
github.com/gpac/gpac/issues/1088
usn.ubuntu.com/3926-1
nvd.nist.gov/vuln/detail/CVE-2018-13005
security-tracker.debian.org/tracker/CVE-2018-13005
Show 12 moreShow less
advisories.mageia.org/MGASA-2019-0146.html
bugs.mageia.org/show_bug.cgi?id=24601
ubuntu.com/security/CVE-2018-13005
cve.org/CVERecord?id=CVE-2018-13005