A weakness has been identified in GPAC up to 26

GPAC is an open-source multimedia framework — MP4Box, the gpac CLI, and the libgpac library used by transcoders, packagers, and a few CDN ingest tools. The flaw lives in src/utils/base_encoding.c inside the ISOBMFF parser path: when GPAC inflates highly compressed metadata embedded in a crafted file, it does not bound the output relative to the input, so a tiny payload expands until memory or CPU is exhausted. Affected versions: GPAC up to and including 26.02.0. Fix: commit 297f2d8d1f493d8b241330533cd47f7da758aeb3, which aborts inflation when output exceeds 32× input.

Vendor LOW (3.3) is *accurate*. CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L says exactly what this is: local attacker, low privileges, availability-only impact. There is no memory corruption, no code execution, no information disclosure. Any user who can hand a file to GPAC can already crash their own GPAC process — and that's the entire blast radius.

Why this verdict

• Local + Low-privilege + Availability-only: CVSS vector tells the whole story. No code execution, no memory corruption, no information leak — just a process crash.
• Friction audit: attacker must already have a way to invoke GPAC on their file. That assumes either a local logged-in user (in which case they're DoS'ing themselves) or a media-processing pipeline that accepts untrusted uploads (a tiny fraction of enterprises, and those typically use ffmpeg).
• Role multiplier: enumerating GPAC's deployment roles — (a) analyst workstation / desktop transcoder = self-DoS, no escalation; (b) backend transcoding service = single job crash, retried by the queue, recovered by cgroup OOM kill; (c) high-value role = *none exist* — GPAC is not an identity provider, hypervisor, EDR agent, CA, backup server, CI runner, or edge appliance. The role-multiplier floor is LOW.
• EPSS 0.00112 + no KEV + no public weaponization: all three exploitation-likelihood signals agree — this stays in the noise floor.
• Compensating controls already standard: any modern container/serverless transcoder runs under memory limits that turn this from outage into job retry.

Why not higher?

MEDIUM would require either network reachability or impact beyond a single process. Neither is present. The CVSS subscore is even slightly inflated because the typical real-world outcome is a retried job, not a sustained service outage.

Why not lower?

IGNORE is wrong because there is a real fix and a real (if narrow) attack — anyone running GPAC server-side against untrusted uploads should still patch on the normal hygiene cycle. LOW correctly says 'backlog, not page'.

1. Run GPAC under strict memory/CPU limits — If GPAC is invoked in a service context, wrap it with systemd-run --property=MemoryMax=2G --property=CPUQuota=200% or a Docker --memory flag. This converts the bug from sustained host degradation into a single failed job. No mitigation SLA for LOW — apply opportunistically.
2. Reject suspicious media before invocation — Pre-screen uploads with ffprobe size/header sanity checks and a max-file-size gate at the upload layer. Useful baseline hygiene against the broader class of media-parser bugs (GPAC, ffmpeg, ImageMagick), not just this CVE.
3. Track distro gpac package updates — Subscribe Debian/Ubuntu/RHEL security trackers and let the regular monthly patch cycle pick this up. Apply within the 365-day remediation window.
4. Audit who actually runs GPAC — Most orgs find GPAC only on a handful of analyst workstations or a single transcoding box. Inventory first — you may be patching three hosts, not ten thousand.

Run on each Linux host that may have GPAC installed (e.g. ./check_gpac.sh on the target). Needs read access to the GPAC binary on PATH; no root required. Outputs VULNERABLE, PATCHED, or UNKNOWN with exit code 1/0/2 respectively.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-13523 (GPAC zlib inflation DoS)
# Compares installed GPAC version against fixed cutoff (>26.02.0 or backported).
set -u

FIXED_AFTER="26.02.0"

if ! command -v MP4Box >/dev/null 2>&1 && ! command -v gpac >/dev/null 2>&1; then
  echo "UNKNOWN: GPAC not installed on this host"
  exit 2
fi

BIN=$(command -v MP4Box || command -v gpac)
RAW=$("$BIN" -version 2>&1 | head -n 5)
VER=$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -n1)

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse GPAC version from: $RAW"
  exit 2
fi

# Distro backport check: look for the fix commit short hash in --help/--version output if vendor stamps it
if echo "$RAW" | grep -qiE '297f2d8|CVE-2026-13523'; then
  echo "PATCHED: $BIN $VER (backport marker present)"
  exit 0
fi

# Pure version comparison
ver_le() { [ "$1" = "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" ]; }

if ver_le "$VER" "$FIXED_AFTER"; then
  echo "VULNERABLE: $BIN $VER (<= $FIXED_AFTER, no backport marker found)"
  exit 1
else
  echo "PATCHED: $BIN $VER (> $FIXED_AFTER)"
  exit 0
fi

Sources

1. OffSeq Threat Radar — CVE-2026-13523
2. Vulnerability-Lookup — CVE-2026-13523
3. GitHub Security Advisory — GHSA-C4WQ-769X-VWCV
4. CVEDetails — GPAC product vulnerabilities
5. GPAC upstream repository
6. GPAC fix commit 297f2d8
7. CISA Weekly Vulnerability Summary (June 2026)
8. FIRST EPSS Model