{"id":"CVE-2026-71614","details":"An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.","modified":"2026-09-11T08:36:48.315542Z","published":"2026-09-09T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71614.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71614.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71614"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3614"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"0e4093392e1f847c90d20e031e893cd942fef938"}],"database_specific":{"source":"REFERENCES"}}],"versions":["abi-16.17","abi-16.16","abi-16.15","abi-16.14","abi-16.13","abi-16.11","abi-16.10","abi-16.9","abi-16.8","abi-16.7","abi-16.6","v26.02.0","abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71614.json","vanir_signatures_modified":"2026-09-11T08:36:48Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"267706410807143064141978002223607207983","length":459},"id":"CVE-2026-71614-6540b33c","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938","target":{"file":"src/media_tools/dvb_mpe.c","function":"section_DSMCC_INT"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["167017643536661699829221738725057711519","144054689975404934488915024035987043517","172657148292128730485288918898518369926","244156923515677339642506525788691988611","314380751998009485003967616943593461104","90445792624362128146002515857461091506","39193373138507607042461463172903422718","172484741783456061641384657611619228333","297831179737929201648992578973908679311","220773563709789011740570946489692024168","153014688867724933885178371295063296386","132682575377384117832751033962344533539","64136591346390095417914091130701281986","47004666594839653183667557139632338800","53432104267591167865671547986127967986","46167685109119898891279214626630197344","137381719325757547996820123992145482548","327727531869132427374912629705621906002","53432104267591167865671547986127967986","299926588276209234146225627690532187852","90304323904622563748244182843523403867","232279644284414344008731126439487271335","162525050577929410401227789291217677941","232321513535769617273354327675297612457","326449817801715496371257288975809132075","198335599757882279591954842287731354720","86727138208307416302224419390292933439","320236542086197803407643748690393253844","258078796308933500286893144199048022523","17291034353084068571021420488734313283"]},"id":"CVE-2026-71614-70610743","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938","target":{"file":"src/media_tools/dvb_mpe.c"}},{"source":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938","target":{"file":"src/media_tools/dvb_mpe.c","function":"descriptorDSMCC_INT_UNT"},"deprecated":false,"digest":{"function_hash":"291335029061353563176932692419617762419","length":433},"id":"CVE-2026-71614-9ce27611","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-71614-9fb23a6a","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938","target":{"file":"src/media_tools/dvb_mpe.c","function":"platform_descriptorDSMCC_INT_UNT"},"deprecated":false,"digest":{"function_hash":"20793328885506903346356681244401906633","length":363}},{"source":"https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938","target":{"file":"src/media_tools/dvb_mpe.c","function":"descriptorTime_slice_fec_identifier"},"deprecated":false,"digest":{"function_hash":"23358260541755395557523596504496630686","length":610},"id":"CVE-2026-71614-da103ae5","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0"}