Security notes: JSON::XS, libdca, Vim, and GPAC

oss-security carried a batch of vulnerability reports on 15 November 2026, led by seven CVEs in Perl JSON::XS and out-of-bounds reads in an unmaintained DTS decoder still packaged by distributions. Lower-ranked items covered a Vim PowerShell plugin flaw, three GPAC/MP4Box issues in XMT handling, and CVE assignments for two old Perl session bugs.

Seven CVEs in JSON::XS before 4.05

JSON::XS versions before 4.05 for Perl were assigned seven CVEs covering memory exhaustion, leaks, buffer corruption, and use-after-free. The report went to oss-security. Anyone still building or packaging that release series is exposed to those memory-safety failures.

Out-of-bounds reads in unmaintained libdca

A reporter disclosed two out-of-bounds reads in scale-factor parsing in libdca, the VideoLAN DTS decoder. The library is unmaintained, but distributions still ship it, so the bugs remain in packaged builds with no upstream maintainer to take a fix.

Command execution in Vim PowerShell keyword lookup

A low-severity command execution flaw was reported in Vim before 9.2.1346. The PowerShell ftplugin can run commands through unhandled typographic quotes during keyword lookup.

Use-after-free in GPAC MP4Box scene teardown

CVE-2026-128240 is a medium-severity use-after-free in gf_sg_proto_del during XMT scene teardown in GPAC/MP4Box. The reporter says the bug is fixed in a recent commit.

Type confusion in GPAC Appearance handling

CVE-2026-124031 is a medium-severity type confusion in Appearance handling when GPAC/MP4Box processes crafted XMT input. A fix has already been committed.

Type confusion in GPAC XMT field-replace commands

CVE-2026-124030 is a medium-severity type confusion in XMT field-replace command handling in GPAC/MP4Box. The oss-security post is the initial disclosure of that issue.

Memcached injection in old HTTP::Session

CVE-2011-10042 was assigned to HTTP::Session versions before 0.43 for Perl. Unfiltered session ids passed to HTTP::Session::Store::Memcached allow memcached command injection.

Unvalidated session ids in old Dancer

CVE-2015-10149 covers Dancer versions before 1.3400 for Perl, which passed unvalidated session ids from the session cookie to the session engine. The 2015 flaw can allow injection via that cookie.