CVE-2026-71614 Code injection in n/a
An attacker can execute arbitrary code in GPAC via crafted media files, requiring users to apply the latest security patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-71614?
CVE-2026-71614 is a high-severity code injection vulnerability in n/a, published on 9 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. Fixed in 0e4093392e1f847c90d20e031e893cd942fef938.
Weakness: CWE-94
Which versions are affected by CVE-2026-71614?
How do I fix CVE-2026-71614?
No fix has been published for CVE-2026-71614 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-71614 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71614 exists.
Sources
Also known as GHSA-c2fm-vm9m-g9xv, UBUNTU-CVE-2026-71614.