CVE-2025-15668
A vulnerability was identified in GPAC up to b40ce70f5.
Does this matter?
Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.
- CVSS 4.0
- 1.9 LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.18% probability · 7th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-122
- Source
- cna@vuldb.com
EPSS 0.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/TimChan2001/pocs/raw/refs/heads/main/poc-gpac-0
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/commit/f29f955f2a3b5e8e507caad3e52319f961bf37bf
- https://github.com/gpac/gpac/issues/3398
- https://vuldb.com/cve/CVE-2025-15668
- https://vuldb.com/submit/846851
- https://vuldb.com/vuln/376293
- https://vuldb.com/vuln/376293/cti
- https://github.com/gpac/gpac/issues/3398
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.