Description

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-15T07:16:34.050Z",
  "pubdate": "2026-09-15T07:16:34.050Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in the MPEG Video Reframer component of GPAC, affecting versions up to f1219cde.\nThe vulnerability resides within the mpgviddmx_process function located in filters/reframe_mpgvid.c.\nThis flaw allows a remote attacker to trigger memory corruption by providing a maliciously crafted MPEG video file to the application.\nSuccessful exploitation of this vulnerability may lead to arbitrary code execution, denial of service (application crash), or unauthorized disclosure of sensitive information within the process memory space.\nGiven that the exploit has been disclosed publicly, the risk of exploitation is elevated. There are no authentication requirements to trigger this vulnerability, making it accessible for remote exploitation via standard network or local file processing vectors.\nUsers and administrators are advised to update to version abi-16.23 or apply the identified patch (afca1f1181668d85941d51ed1adf647807d5d975) immediately to mitigate this risk.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow localized within the mpgviddmx_process function in the file filters/reframe_mpgvid.c of the GPAC MPEG Video Reframer component. The root cause pertains to improper validation of input data length during the processing of MPEG video stream frames.\nWhen the MPEG Video Reframer parses incoming video streams, it fails to adequately verify the size of the data being copied into an allocated heap buffer. Specifically, the function mpgviddmx_process processes input chunks without enforcing strict bounds checking on the destination buffer. By providing an MPEG video frame with malformed header fields or payload lengths that exceed the pre-allocated buffer capacity, an attacker can cause the reframer to write out-of-bounds data into the heap.\nThe attack flow begins when the GPAC engine parses a maliciously crafted MPEG stream. The attacker delivers this stream via standard file import or a network-based media delivery protocol. Upon hitting the vulnerable mpgviddmx_process function, the lack of input sanitization leads to a memory overwrite. Because the target is a heap-allocated buffer, the overflow can corrupt adjacent metadata (such as heap chunk headers or application-specific pointers) or override sensitive function pointers residing in the heap, enabling the redirection of the program control flow.\nThe exploitation of heap-based overflows typically involves grooming the heap memory to place controlled data at a specific memory location relative to the destination buffer. By overwriting objects on the heap, an attacker can achieve arbitrary read/write primitives. In the context of GPAC, successful exploitation facilitates the execution of arbitrary code with the privileges of the user running the GPAC application.\nThis vulnerability does not require authentication or elevated privileges, as the processing of media content is often automated or performed by users interacting with standard interface controls. The lack of proper length validation in filters/reframe_mpgvid.c is the primary point of failure. This vulnerability affects all GPAC versions up to f1219cde. The patch provided (afca1f1181668d85941d51ed1adf647807d5d975) introduces the necessary bounds checking logic within the reframing process to ensure that the memory write operations remain within the allocated buffer boundaries."
}