Description

A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T02:17:15.150Z",
  "pubdate": "2026-09-14T02:17:15.150Z",
  "executiveSummary": "A buffer over-read vulnerability has been identified in the MP4Box component of the GPAC multimedia framework, specifically within the gf_svg_attributes_copy function.\nThis vulnerability, present in versions up to f1219cde, allows an attacker to perform unauthorized memory reads, potentially leading to information disclosure or application instability.\nThe flaw originates from improper bounds checking during the processing of SVG attributes within the scenegraph/svg_attributes.c file.\nExploitation requires local access to the system, necessitating that an attacker be able to supply a crafted file to the vulnerable MP4Box component.\nGiven that exploit code is publicly available, the risk to confidentiality is elevated. Upgrading to version abi-16.23 is the primary remediation strategy to address the flawed memory handling logic.\nSuccessful exploitation depends on the ability of an attacker to execute the binary against a malicious input file, resulting in an out-of-bounds memory read condition.",
  "technicalDetails": "The vulnerability is a classic buffer over-read located in the gf_svg_attributes_copy function within the scenegraph/svg_attributes.c source file of the MP4Box component. This function is responsible for duplicating attributes in SVG-based scene graphs, a process that involves copying memory buffers from a source structure to a destination structure.\nThe root cause of this security defect is the failure to validate the length of the source attribute data against the destination buffer size. When the function processes an SVG attribute, it does not adequately verify that the input data size adheres to the pre-allocated buffer limits. Consequently, when a crafted file is provided, the function continues to read beyond the intended boundary of the source buffer.\nThe attack flow commences when a user, acting as a local attacker, invokes MP4Box to process a malicious file containing malformed SVG attribute definitions. Upon encountering the specific attribute, the internal state machine triggers the gf_svg_attributes_copy function. Because of the lack of bounds checking, the pointer arithmetic continues into adjacent memory regions. This allows the process to read and potentially expose sensitive information stored in the heap or adjacent memory segments.\nSince the exploit code is publicly available, an attacker can leverage this primitive to dump sensitive memory contents or induce a segmentation fault, leading to a crash and potentially a Denial of Service (DoS) condition. The vulnerability is restricted to local exploitation because the attacker must have the ability to execute the GPAC binary on the target filesystem with a target file provided as input.\nThe memory safety issue is inherent to the C implementation of the attribute handling logic, which lacks sufficient sanity checks for input length verification before performing memory copy or read operations. This exposure persists in all GPAC versions up to f1219cde. Remediation involves applying the patch identified as afca1f1181668d85941d51ed1adf647807d5d975, which introduces the necessary bounds checking logic to ensure that memory access operations stay within the allocated buffer boundaries, thereby preventing the over-read condition."
}