Vulnerabilities

GPAC v26.07.0, an open-source multimedia framework, contains an out-of-bounds read (CWE-125) in the gf_dm_get_chunk_data function in src/utils/downloader.c. The flaw is triggered when GPAC's HTTP downloader processes a crafted HTTP request/response, for example when a user opens or streams a remote media URL under an attacker's control, causing the application to crash. The impact is limited to denial of service — there is no indication of information disclosure, code execution, or integrity impact (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Users and automated pipelines running GPAC 26.07.0 that fetch content over HTTP are affected; the issue is fixed in upstream commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. A public proof of concept exists via a GitHub issue tracker entry, but EPSS is very low (0.2%, 16th percentile), the CVE is not in CISA's KEV, and no exploitation in the wild is known.

Do: Upgrade GPAC to any build containing fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (post-26.07.0) or apply the patch to downstream packages. Until patched, avoid opening or streaming remote/untrusted HTTP URLs in GPAC and restrict automated pipelines from fetching media from untrusted sources. The flaw is denial-of-service only, so prioritize it below confidentiality/integrity issues, but monitor crashes in downloader code as an indicator of attempted triggering.

MessagePack for Ruby (the msgpack-ruby gem) prior to version 1.8.2 contains a stale-pointer flaw (CWE-416) in MessagePack::Buffer#clear: when the C extension returns an internal read-memory (rmem) page to the shared pool via _msgpack_buffer_shift_chunk, the rmem_last, rmem_end, and rmem_owner fields are left pointing at the freed page. A subsequent Buffer#write on the cleared buffer, combined with a second MessagePack::Buffer in the same process allocating that recycled page, causes both buffers to alias the same memory. An attacker with local access or the ability to influence serialized data in such a process can read or corrupt data belonging to the other buffer; the CVSS 4.0 score of 2.1 assesses the impact as low-severity information disclosure with a local attack vector. Any Ruby application using MessagePack serialization (commonly for caching, RPC, or message handling) on versions before 1.8.2 is affected, but triggering requires a specific clear-then-reuse buffer pattern. No in-the-wild exploitation is known: the flaw is not in CISA KEV, EPSS estimates a 0.2% probability of exploitation within 30 days, and the only public reference is the GitHub advisory GHSA-4mrv-5p47-p938.

Do: Upgrade msgpack-ruby to version 1.8.2 or later. As an interim mitigation, avoid calling MessagePack::Buffer#clear on buffers that are subsequently reused (allocate fresh buffers instead) and audit code paths that clear and reuse MessagePack buffers within a single process. Given the local attack vector, prioritize hosts that run untrusted local code or multi-tenant Ruby processes.

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).

A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.

Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.

GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/dmx_nhml.c`. The value of the xmlHeaderEnd XML attribute is copied from att->value into szXmlHeaderEnd[1000] using strcpy() without any length validation. If the input exceeds 1000 bytes, it overwrites beyond the stack buffer boundary. Commit 9bd7137fded2db40de61a2cf3045812c8741ec52 patches the issue.

A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.

A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.