CVE-2026-71612

A buffer overflow (CWE-120, buffer copy without checking input size) in GPAC's NHNT demuxer, in the nhntdmx_process() function, lets an attacker execute arbitrary code by supplying a crafted NHNT media file to a vulnerable GPAC build. The flaw is present at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and was fixed in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6. The CVSS 3.1 vector is local (AV:L) with no privileges or user interaction required, so practical risk centers on untrusted local users and automated media-processing/transcoding pipelines that pass attacker-supplied files to gpac/MP4Box. Successful exploitation runs code with the privileges of the GPAC process, giving full confidentiality, integrity, and availability impact on that host. There is no public PoC, the CVE is not in the CISA KEV catalog, and EPSS is very low (0.2%, 7th percentile), so no exploitation is currently known.

What to do: Update GPAC to a build containing fix commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 (pull latest git master or the next release that includes it, and verify the build's commit). In the meantime, do not process untrusted or user-supplied NHNT (.nhnt/.media) files, and run gpac/MP4Box under a sandbox, container, or restricted-privilege account in automated transcoding or file-analysis pipelines. If you consume GPAC via a distro package (Debian, Ubuntu, Fedora, Homebrew) or a third-party product that embeds it, check with the maintainer for a patched build.