Description

A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T06:16:58.507Z",
  "pubdate": "2026-09-14T06:16:58.507Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified in the MP4Box component of GPAC, specifically within the gf_bt_report function of scene_manager/loader_bt.c.\nThe vulnerability allows remote attackers to trigger memory corruption through specifically crafted input, potentially leading to arbitrary code execution or denial-of-service conditions.\nThe flaw affects GPAC versions up to commit f1219cde.\nGiven that exploit code has been made publicly available, the risk of exploitation is high, and the vulnerability is actively accessible via remote attack vectors.\nUsers and administrators are advised to prioritize updating to version abi-16.23 to mitigate this security risk effectively.",
  "technicalDetails": "The vulnerability is situated within the scene_manager/loader_bt.c file of the MP4Box component, specifically within the gf_bt_report function, which is responsible for processing Binary Format for Scenes (BT) files.\nThe root cause of this vulnerability is an improper handling of input data during the parsing or reporting phase of the BT file format. This leads to a memory corruption event, which may involve heap-based buffer overflows or invalid memory access patterns during the object reporting lifecycle.\nThe attack flow begins when an attacker provides a malformed or maliciously crafted BT file to an application utilizing the GPAC library. When the MP4Box component invokes gf_bt_report to process the file, the function fails to perform adequate bounds checking or validation on the input buffers or structured data fields.\nAs the function processes the malformed input, it overwrites adjacent memory segments or performs operations on pointers that have been invalidated. Depending on the memory layout and the nature of the corruption, this can be leveraged by an attacker to manipulate the execution flow of the application.\nBecause the vulnerability is reachable through the processing of media files, the attack vector is remote. An attacker can host the malicious file on a web server or embed it within media content intended to be processed by GPAC-based software, requiring no authentication or specific user privileges to initiate the parsing sequence.\nSuccessful exploitation may allow the attacker to execute arbitrary code with the privileges of the application process. If code execution is not achieved, the memory corruption will likely lead to an application crash, resulting in a denial-of-service (DoS) condition.\nThe vulnerability is patched in commit afca1f1181668d85941d51ed1adf647807d5d975, which introduces robust validation logic to ensure that input buffers are handled securely within the gf_bt_report function, effectively preventing the corruption condition.\nThe affected versions include all releases up to commit f1219cde, and users must migrate to version abi-16.23 to remediate this flaw."
}