LiveActive security incident?Get immediate response
CVE Record

CVE-2018-20761: GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene...

GPAC version 0.7.1 and earlier has a Buffer Overflow vulnerability in the gf_sm_load_init function in scene_manager.c in libgpac_static.a.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2018-20761 is a buffer overflow in GPAC 0.7.1 and earlier. It affects the gf_sm_load_init function in GPAC's scene manager code. The public bundle does not include a CVSS score, confirmed exploitation, or detailed impact, so urgency should be based on whether GPAC processes untrusted content in your environment.

Executive priority

Prioritize based on exposure. If GPAC processes untrusted content, treat this as a near-term remediation item because buffer overflows can affect service stability and security. If GPAC is absent or unused, business urgency is low.

Technical view

The CVE describes a buffer overflow in gf_sm_load_init in scene_manager.c, distributed in libgpac_static.a for GPAC 0.7.1 and earlier. Upstream, Debian LTS, and Ubuntu references indicate remediation activity, but the provided data lacks CVSS, CWE, exploitability details, and fixed version specifics.

Likely exposure

Exposure is most likely where GPAC 0.7.1 or earlier is installed or embedded, especially in systems that process externally supplied media or scene content. The bundle does not identify downstream products or packaged versions beyond GPAC itself.

Exploitation context

There is no KEV listing and no cited source in the bundle confirming active exploitation. The issue type is memory corruption, but the provided evidence does not establish exploit reliability, required input format, privileges, or real-world attack activity.

Researcher notes

The source bundle is sparse. It confirms affected GPAC versions and vulnerable function, plus upstream and distro remediation references. It does not provide CVSS, CWE, proof-of-concept status, fixed version numbers, exploit prerequisites, or affected downstream products.

Mitigation direction

  • Inventory systems and applications using GPAC 0.7.1 or earlier.
  • Apply relevant Debian or Ubuntu GPAC security updates where applicable.
  • Review the upstream GPAC commit for code-level remediation context.
  • Check GPAC vendor guidance for fixed release information.
  • Reduce GPAC processing of untrusted files until patched.

Validation and detection

  • Confirm installed GPAC versions across servers, build images, and containers.
  • Check whether applications statically link libgpac_static.a.
  • Verify Debian or Ubuntu package updates are installed where relevant.
  • Review file-processing paths for untrusted GPAC inputs.
  • Document any embedded GPAC dependency owners and remediation status.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-20761 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.