Description

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.9",
  "pubDate": "2026-09-15T08:17:06.807Z",
  "pubdate": "2026-09-15T08:17:06.807Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists within the GPAC multimedia framework, specifically affecting the gf_node_activate_ex function.\nThis vulnerability originates from improper memory handling during the activation of nodes within the scenegraph structure.\nSuccessful exploitation allows for memory corruption, which may lead to arbitrary code execution or a denial-of-service state on the host system.\nThe flaw affects GPAC versions up to commit f1219cde.\nThe attack vector is local, requiring the target system to process a maliciously crafted input that triggers the flawed function.\nGiven that exploit details have been publicly disclosed, the risk of exploitation is elevated.\nImmediate remediation involves upgrading the GPAC framework to version abi-16.23 or applying the vendor-provided patch.\nUsers are advised to restrict application execution privileges and avoid processing untrusted multimedia files until the update is applied.",
  "technicalDetails": "The vulnerability is located in the gf_node_activate_ex function within the scenegraph/base_scenegraph.c source file.\nThe root cause is a stack-based buffer overflow, where the function fails to adequately validate the bounds of input data before writing to a stack-allocated buffer.\nDuring the processing of nodes in the scenegraph, the implementation does not enforce strict length constraints on incoming data structures during the activation process.\nAn attacker can exploit this by providing a specially crafted input that exceeds the intended size of the stack buffer, allowing the overwrite of adjacent stack memory.\nBy controlling the data written to the stack, an attacker can overwrite return addresses, saved frame pointers, or local variables.\nWhen the function terminates, the CPU utilizes the corrupted return address, potentially redirecting the instruction pointer to attacker-controlled memory segments.\nThe exploitation process typically involves: 1) Identification of the buffer size constraints within gf_node_activate_ex; 2) Creation of a malicious input stream designed to overflow the stack; 3) Delivery of the payload via a local process that invokes the vulnerable GPAC component; 4) Triggering the buffer overflow to execute arbitrary code with the privileges of the GPAC process.\nThe vulnerability is limited to the local host environment as described; however, it remains a critical issue for any application or service relying on GPAC for multimedia parsing or scenegraph management.\nNo specific authentication or advanced privilege requirements are noted, as the execution occurs within the context of the user or process running the affected GPAC build.\nThe issue persists in all versions of the software up to the commit hash f1219cde. Protection is achieved by upgrading to version abi-16.23, which incorporates the necessary bounds checking and memory safety fixes addressed in patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24."
}