Kery Qi

**Name of the Vulnerable Software and Affected Versions** GPAC version 26.02.0 **Description** A flaw in the Media File Handler component allows a null pointer dereference, which occurs when a program attempts to read from a memory address that is null, typically leading to a crash. This issue is located in the `nhmldump send frame()` function within the `src/filters/write nhml.c` file. Exploitation requires local access. **Recommendations** Apply patch bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 to version 26.02.0.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** A stack-based buffer overflow exists in the Memory64ListStream Parser component within the file `libr/bin/format/mdmp/mdmp.c`. This issue can be triggered through local manipulation. **Recommendations** Install patch 175d4addb68981331c85b10681c2161c38fb5762 to resolve this issue.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** An integer overflow occurs in the `r str word get0set()` function within the libr/util/str.c file. This issue allows a local attacker to trigger the overflow through specific manipulation. **Recommendations** Apply patch 11ac224c0eb8d57830fccc99e1c1cd8e5d958813 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** A use after free issue exists in the `r core bin load()` function within the libr/core/cfile.c file. This flaw allows a local attacker to trigger the condition through specific manipulation. Use after free is a memory corruption flaw where an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. **Recommendations** Apply patch 635ab1eeb30340c26076722a90cb91fb2272130b to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** An integer overflow occurs in the `cmd print()` function within the `libr/core/cmd print.inc` library of the pb Print Command Handler component. This issue requires local access to be exploited. **Recommendations** Apply patch 2b6265476c75567006b0fcbb749f4ae7b189c5df to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** A heap-based buffer overflow occurs in the RBinJava Line Number Table Parser component within the `r bin java inner classes attr calc size()` function located in the shlr/java/class.c file. This issue can be triggered through local manipulation. **Recommendations** Apply patch cd62d15a6cbecdc67fd03f3ebdbbbeb741d18f87 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** An integer overflow occurs in the `core anal bytes()` function within the libr/core/cmd anal.inc file. This issue requires local access to be exploited. **Recommendations** Install the available patch for versions prior to 6.1.7.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** An integer overflow occurs in the hexpairs Parser component within the `cmd anal opcode()` function located in the libr/core/cmd anal.inc.c file. This issue requires local access to be exploited. **Recommendations** Apply patch 84e773986e7e5bb30453a9384f498ec0ccc9d0a9 to versions prior to 6.1.7.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** A use after free issue exists in the regprofile Handler component within the `r core seek arch bits()` function of the `libr/core/disasm.c` file. A use after free occurs when a program continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. This flaw requires local access to be exploited. **Recommendations** Apply patch 8b25c773785d85cb0103410a0905089d286921c2 to resolve the issue. As a temporary mitigation, restrict local access to the system to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** radareorg radare2 versions prior to 6.1.7 **Description** An integer overflow occurs in the `r str ndup()` and `r str append()` functions within the libr/util/str.c file. This issue requires local access to be exploited. **Recommendations** Apply the patch identified as a20a56917ae85d732e683f8d9078bdcfee92446c for versions prior to 6.1.7.

**Name of the Vulnerable Software and Affected Versions** GPAC versions up to 2.4.0 **Description** A security issue exists in GPAC related to the SRT Subtitle Import function. The `gf text import srt bifs` function within the `src/scene manager/text to bifs.c` file is susceptible to an out-of-bounds write condition. This manipulation requires local access. The exploit has been publicly disclosed. **Recommendations** Apply patch 10c73b82cf0e367383d091db38566a0e4fe71772.

**Name of the Vulnerable Software and Affected Versions** GPAC versions prior to 2.4.0 **Description** A flaw exists in GPAC due to a null pointer dereference in the `dump isom rtp` function within the `applications/mp4box/filedump.c` file. This issue can be triggered locally. The exploit for this issue is publicly available. **Recommendations** Apply the patch f96bd57c3ccdcde4335a0be28cd3e8fe296993de.

**Name of the Vulnerable Software and Affected Versions** GPAC versions up to 2.4.0 **Description** A security flaw exists in GPAC due to a null pointer dereference in the `DumpMovieInfo` function located in the `applications/mp4box/filedump.c` file. This manipulation can be initiated locally. The exploit for this issue has been publicly released and may be used in attacks. **Recommendations** Implement the patch d45c264c20addf0c1cc05124ede33f8ffa800e68 to correct this issue.

**Name of the Vulnerable Software and Affected Versions** GPAC versions up to 2.4.0 **Description** A flaw exists in GPAC where manipulation of the `Name` argument within the `gf media export webvtt metadata` function, located in the `src/media tools/media export.c` file, can lead to a null pointer dereference. This issue requires local access to exploit. The exploit is publicly available. **Recommendations** Deploy the patch with identifier af951b892dfbaaa38336ba2eba6d6a42c25810fd.

**Name of the Vulnerable Software and Affected Versions** uclouvain openjpeg versions prior to 2.5.5 **Description** An integer overflow occurs in the `opj pi initialise encode()` function within the `src/lib/openjp2/pi.c` library. This issue requires local access to be exploited. **Recommendations** Install the patch identified as 839936aa33eb8899bbbd80fda02796bb65068951 for versions prior to 2.5.5.