Description

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T21:17:42.550Z",
  "pubdate": "2026-09-14T21:17:42.550Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability has been identified in the MP4Box component of GPAC 26.07.0.\nThe vulnerability resides within the gf_sg_dom_event_bubble function located in src/scenegraph/dom_events.c.\nThis flaw allows for unauthorized memory corruption, potentially leading to arbitrary code execution or application crashes.\nThe exploit is restricted to local environments, requiring an attacker to have local access to the system to trigger the vulnerability.\nPublic disclosure of exploit code increases the risk of exploitation. Users are advised to upgrade to version abi-16.23 immediately to address the underlying security flaw.\nThe impact is significant, as successful exploitation can compromise the integrity and availability of the affected system.",
  "technicalDetails": "The vulnerability is a stack-based buffer overflow occurring within the gf_sg_dom_event_bubble function of the src/scenegraph/dom_events.c file in the GPAC MP4Box component.\nThe root cause of the vulnerability lies in improper bounds checking during the processing of DOM events within the scenegraph implementation.\nWhen the affected function processes event data, it fails to sufficiently validate the size of the input relative to the destination stack buffer, leading to an overflow condition where data exceeds the allocated stack space.\nExploitation is achieved by providing a specially crafted input file to MP4Box that triggers the vulnerable code path in gf_sg_dom_event_bubble. Upon processing the malicious event structure, the overflow overwrites adjacent memory on the stack, including saved return addresses or frame pointers.\nBy precisely controlling the overflow data, an attacker can redirect the execution flow of the application to execute arbitrary code or shellcode payloads injected into the stack.\nSince the vulnerability is stack-based, it is particularly susceptible to modern exploitation techniques such as Return-Oriented Programming (ROP) if address space layout randomization (ASLR) or stack canaries are not effectively employed or bypassed.\nThe attack vector is strictly local, meaning the attacker must be capable of executing MP4Box on the target system or convincing a local user to process a malicious file with the vulnerable GPAC binary.\nThe impact of a successful exploitation includes unauthorized code execution with the privileges of the user running the GPAC application, leading to potential system compromise, data theft, or denial of service.\nThe flaw affects GPAC version 26.07.0 and is corrected in version abi-16.23 via patch identifier 9eb40df4448b88d6a6ce3454657c06f47eff0b24."
}