CVE-2026-71614

GPAC, an open-source multimedia framework, contains an arbitrary code execution flaw (CWE-94) in its DVB Multi-Protocol Encapsulation handling in src/media_tools/dvb_mpe.c, specifically in the descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() functions. It is triggered when a vulnerable GPAC build (e.g., MP4Box or a gpac filter session) parses a maliciously crafted MPEG-2 transport stream containing DVB-MPE data or time-slice/FEC descriptors. Successful exploitation allows an attacker to execute code with the privileges of the process that parsed the stream, which in media-packaging or ingest pipelines may be an automated service account. The CVSS 3.1 vector (8.4, AV:L/AC:L/PR:N/UI:N) indicates a local attack vector: the attacker must get the crafted file processed by the victim application, but no privileges or user interaction are required beyond that. The vulnerable code was present at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and was fixed in commit 0e4093392e1f847c90d20e031e893cd942fef938; there is no public PoC, the issue is not in the CISA KEV catalog, and no exploitation has been observed in the wild.

What to do: If you use GPAC to process third-party or untrusted MPEG-2 transport streams, update to a build containing fix commit 0e4093392e1f847c90d20e031e893cd942fef938 or a downstream package that includes it. Until then, stop feeding untrusted DVB-MPE/broadcast-capture content into MP4Box or gpac filter sessions, and run such processing in isolated containers or VMs with minimal privileges. Audit packaging, transcoding, and ingest pipelines that invoke GPAC on externally supplied media, since those are the realistic targets for a crafted-stream attack.