Description

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-09-15T07:16:34.423Z",
  "pubdate": "2026-09-15T07:16:34.423Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists in the GPAC URL Handler component, specifically within the gf_url_concatenate_ex function.\nThe vulnerability affects GPAC versions up to f1219cde and presents a significant security risk by potentially allowing arbitrary code execution or application crashes.\nExploitation requires the attacker to have local access to the system to trigger the flawed processing logic within the URL concatenation routine.\nSuccessful exploitation allows for memory corruption, which may be leveraged by a local attacker to compromise the integrity or availability of the affected process.\nThe issue is resolved by upgrading the software to version abi-16.23, which incorporates the necessary security patch to ensure memory safety during URL string handling.",
  "technicalDetails": "The vulnerability is located in utils/url.c within the gf_url_concatenate_ex function. The root cause is an improper bounds check or memory allocation strategy when concatenating URL strings, resulting in a heap-based buffer overflow.\nIn the context of the URL Handler component, the function is responsible for merging path components or URL segments. When the input provided to this function exceeds the pre-allocated buffer size without adequate verification of the destination buffer's capacity, a write operation occurs past the designated memory boundary.\nThe attack flow begins when an attacker provides a maliciously crafted URL or input string that is passed to the gf_url_concatenate_ex function. Because the function fails to correctly validate the length of the concatenated output against the heap-allocated memory buffer, the extraneous data overflows into adjacent heap chunks.\nThis overflow allows an attacker to overwrite critical data structures, function pointers, or objects residing in heap memory. By carefully controlling the overflow payload, an attacker can manipulate program flow or alter application state to execute arbitrary code with the privileges of the GPAC process.\nSince the vulnerability is localized to the URL concatenation logic, it does not require network interaction in the traditional sense, but requires the attacker to be present on the local host to provide the malicious input to the targeted binary or service.\nThis vulnerability is addressed via patch afca1f1181668d85941d51ed1adf647807d5d975, which likely implements proper length checking or dynamic reallocation sizing to ensure that the resultant concatenated string never exceeds the size of the allocated heap buffer.\nPost-exploitation impact involves the potential for complete control over the application's execution context, which may lead to privilege escalation or further exploitation of the host environment depending on the context in which GPAC is executed."
}