ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-4016

A security vulnerability has been detected in GPAC 26.03-DEV.

Published Mar 12, 2026 · catalog updated Jun 17, 2026

Severity
Low1.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.2%
Remediation
Not established
Affected products
See sources for product scope

A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2. It is suggested to install a patch to address this issue.

Technical analysis

Mechanism and impact are interpreted from ingested advisories — not independent exploit research.

  • CWE classification

    Buffer Overflow · Out-of-bounds Write

  • Prerequisites and impact

    Follow the original vendor advisory for access prerequisites and impact. This catalog does not invent exploit conditions.

How to fix CVE-2026-4016

What to do

Three reads of the same public record: the decision, the versions on file, and the signals. Confirm the vendor advisory before you patch. This page does not publish exploit steps.

Executive

This is a public record, not a confirmed incident. CVE-2026-4016 is a low issue in the affected product (CVSS 1.9). CISA does not currently list it as known exploited. Next step: Compare installed versions with the linked vendor advisory before changing production.

System administrator

Check whether the affected product is installed. Affected ranges are not on this record yet. Compare installed versions with the linked vendor advisory before changing production.

Security analyst

CVSS 1.9. EPSS 0.2%. CISA does not currently list it as known exploited. Weaknesses: CWE-119, CWE-787. Sources: cve_org, epss, nvd. Exploit links, when listed below, point at the original publisher.

Related intelligence

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 12, 2026 · NIST NVD

    Detected

    A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 7618d7206cdeb3c28961dc97ab0e

  2. Jun 17, 2026 · NIST NVD

    Updated

    A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 7618d7206cdeb3c28961dc97ab0e

Sources

  • CVE.orgVulnerability recordCVE-2026-4016

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-4016

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-4016

    A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this atta

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.