CVE-2023-1655

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-1655
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1655.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-1655
Downstream
Published
2023-03-27T00:00:00Z
Modified
2026-07-22T02:09:08.455395Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Heap-based Buffer Overflow in gpac/gpac
Details

Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.

Database specific 
{
    "cna_assigner": "@huntrdev",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1655.json",
    "cwe_ids": [
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5d70253ac94e5840be7b86054131dd753af63cc7
Fixed
e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4
Database specific 
{
    "cpe": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0

Database specific

vanir_signatures_modified 
"2026-07-22T02:09:08Z"
vanir_signatures 
[
    {
        "target": {
            "file": "src/filters/reframe_rawpcm.c"
        },
        "id": "CVE-2023-1655-3c402887",
        "digest": {
            "line_hashes": [
                "318272232109742166985015094536697225242",
                "221236678109456604157263013172807717238",
                "277865214903396827771618897476293937125",
                "272942806729890599600254533063322991960",
                "318844698336108762723034294936321604239",
                "329216109777627982820534922723874699941",
                "215685716164610697747382805803312112132",
                "15469796515733859766920536287694573359",
                "250796319547123837685379131138012802566",
                "102236662579749121613072798131536099584",
                "154125495862581611911616805462536529411",
                "152924356733984361392872817324557440400",
                "218336943783742479602580438281258856636",
                "53391041273617134331202003263371122788",
                "136727173737891208527893124196518843741"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"
    },
    {
        "target": {
            "file": "src/filters/decrypt_cenc_isma.c"
        },
        "id": "CVE-2023-1655-63a629ce",
        "digest": {
            "line_hashes": [
                "249571260538932152670445539545228447305",
                "152587707489286048113487046699269700399",
                "179615268150946079356232227478217568912",
                "60033637154988124640604107946683507742",
                "282739834311121068751546966263810654625",
                "337334203508275543620516398168354778384",
                "210797623534005381670211559059867641832"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/gpac/gpac/commit/5d70253ac94e5840be7b86054131dd753af63cc7"
    },
    {
        "target": {
            "function": "pcmreframe_process",
            "file": "src/filters/reframe_rawpcm.c"
        },
        "id": "CVE-2023-1655-92c3c5a6",
        "digest": {
            "function_hash": "283741461627766629122018012647522926488",
            "length": 4658.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"
    },
    {
        "target": {
            "function": "gf_bs_skip_bytes",
            "file": "src/utils/bitstream.c"
        },
        "id": "CVE-2023-1655-9bea63bc",
        "digest": {
            "function_hash": "203656322894861235209213461815077703107",
            "length": 1045.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"
    },
    {
        "target": {
            "function": "cenc_dec_load_keys",
            "file": "src/filters/decrypt_cenc_isma.c"
        },
        "id": "CVE-2023-1655-b25b15ba",
        "digest": {
            "function_hash": "339597387818010758170673273113920787195",
            "length": 3266.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/gpac/gpac/commit/5d70253ac94e5840be7b86054131dd753af63cc7"
    },
    {
        "target": {
            "file": "src/utils/bitstream.c"
        },
        "id": "CVE-2023-1655-be549792",
        "digest": {
            "line_hashes": [
                "217153464431369810088353550240477253197",
                "193765350692698329100038856559947001140",
                "171913979689956171696219296860951797364",
                "290341704576820777074843110085625187866"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1655.json"