Is CVE-2026-4016 actively exploited?

No active exploitation of CVE-2026-4016 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-4016 be exploited remotely?

No. CVE-2026-4016 requires local access to exploit.

What is the CVSS score of CVE-2026-4016?

CVE-2026-4016 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-4016

MEDIUM

CVE-2026-4016

CWE-119Published: March 12, 2026· Updated: Mar 12, 2026

5.3

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.9th

Official Description

A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2. It is suggested to install a patch to address this issue.

NVD Source

Technical Analysis

CVE-2026-4016 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.