Security readout for executives and security teams
Plain-English summary
GPAC had an off-by-one memory handling flaw before v2.3.0-DEV. A local user interaction scenario could let a crafted input affect confidentiality and integrity, but the source bundle does not show remote exploitation or known active exploitation.
Executive priority
Prioritize patching where GPAC processes third-party media or content. This is a high-severity integrity and confidentiality issue, but current provided evidence does not show active exploitation or remote unauthenticated attack exposure.
Technical view
CVE-2023-0818 is CWE-193 in gpac/gpac before v2.3.0-DEV. CVSS 3.0 is 7.1 with local attack vector, low complexity, no privileges, required user interaction, and high confidentiality and integrity impact with no availability impact.
Likely exposure
Exposure is most relevant on systems where GPAC is installed or invoked to process media or content from external or untrusted sources. Debian users should check DSA-5411 coverage. The bundle does not provide precise affected package versions beyond before v2.3.0-DEV.
Exploitation context
The CVSS vector indicates local exploitation requiring user interaction. The provided sources do not establish internet-scale remote exploitation, public weaponization, or CISA KEV listing. Treat untrusted media-processing workflows as the higher-risk context.
Researcher notes
Key gaps are exact affected release ranges, proof-of-exploit status, and downstream package mapping. Use the upstream commit, huntr report, CVE record, and Debian DSA to confirm vulnerable code paths and fixed package lineage without relying on unsupported exploit assumptions.
Mitigation direction
- Update GPAC to a fixed version at or after the referenced upstream commit.
- Apply Debian security updates covered by DSA-5411 where applicable.
- Limit GPAC processing of untrusted files until updates are confirmed.
- Check vendor and distribution advisories for exact package names and fixed builds.
Validation and detection
- Inventory systems and containers for gpac/gpac or distribution GPAC packages.
- Confirm installed versions are not older than the fixed upstream line.
- Review Debian hosts against DSA-5411 fixed package guidance.
- Check media-processing pipelines for GPAC handling external user-supplied content.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-193: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-0818 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N1.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
7.1HighVector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://huntr.dev/bounties/038e7472-f3e9-46c2-9aea-d6dafb62a18aCVE reference
- https://github.com/gpac/gpac/commit/377ab25f3e502db2934a9cf4b54739e1c89a02ffCVE reference
- DSA-5411CVE reference · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Off-by-one Error
Off-by-one Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.