CVE-2026-71613

GPAC, the open-source multimedia framework that includes the MP4Box tool, contains a buffer overflow (CWE-120) in j2kdec_process(), the routine that decodes JPEG 2000 image data. The flaw is triggered when a GPAC build containing commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 processes a media file or codestream with crafted JPEG 2000 content; the CVSS vector (AV:L, UI:R) indicates it requires a local user to open or decode the malicious file. Successful exploitation lets an attacker execute arbitrary code with the privileges of the process running GPAC (e.g., an MP4Box job, a gpac CLI invocation, or an application embedding the library). Anyone using or embedding GPAC to process untrusted media is potentially affected, though the data identifies only commit hashes, not released version numbers. No exploitation has been reported: the issue is not in CISA KEV and no public proof-of-concept is known, and it is fixed in commit 9a253a07fd3f6b48022bba74302bf39388dda859.

What to do: Rebuild or upgrade GPAC to a build containing fix commit 9a253a07fd3f6b48022bba74302bf39388dda859 (or the next stable release that includes it), and redeploy any applications that embed the gpac library. Until patched, avoid using GPAC/MP4Box to decode untrusted JPEG 2000 content, or restrict processing to trusted files. Inventory endpoints and pipelines that process third-party media with GPAC, since exploitation requires a local user to trigger decoding.