CVE-2025-55667
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attacke
CVSS
5.5
Média
EPSS
0.2%
p16
KEV
—
Exploit Today
5
0-100
Publicado: 19 de out. de 2026 · Última mod.: 28 de out. de 2026 · CWE-119
0.2%EPSS · 30 dias0.2%
2026-10-202026-11-06
A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
- github.comhttps://github.com/gpac/gpac/commit/e6d01820d7bf3967d931fedb379ee5f209bc133b
- github.comhttps://github.com/gpac/gpac/issues/3321
- github.comhttps://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
- infosec.exchangehttps://infosec.exchange/@sigdevel/117456648463009125
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/10/20/8
- github.comhttps://github.com/gpac/gpac/issues/3321
- github.comhttps://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/57/57_dump_isom_saps_filedump_c_1743
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-12396610.0 CRÍ—
———A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the file /goform/saveParentControlInfo. This manipulation of the argument deviceId causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.5hCVE-2026-1239619.9 CRÍ—
———A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.8hCVE-2026-1239609.9 CRÍ—
———A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument pppoeUser/priDns/secDns can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.9hCVE-2026-1239599.1 CRÍ—
———A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.9hCVE-2026-1239589.9 CRÍ—
———A vulnerability was identified in TOTOLINK CA300-PoE 6.2c.884. The affected element is the function setLanConfig of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument lanDns/lanSecDns/langType leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.10hCVE-2026-1239579.9 CRÍ—
———A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.10h