Executive brief
A vulnerability exists in GPAC, a multimedia framework used for video streaming and delivery. The software's media parser does not properly limit the size of decompressed data, which could allow a local attacker to cause a 'zip bomb' effect. This can lead to excessive resource consumption, potentially crashing the application or slowing down the system.
Technical details
An improper handling of highly compressed data (CWE-409) vulnerability exists in the GPAC ISOBMFF parser, specifically within the `gf_gz_decompress_payload_ex` function in `src/utils/base_encoding.c`. The component fails to validate the output size of zlib inflate operations, allowing for data amplification attacks (zip bombs). A local attacker can provide a specially crafted file that expands to a much larger size than the input, leading to a denial-of-service condition via resource exhaustion. The vendor addressed this in commit 297f2d8 by implementing a check that ensures the decompressed output does not exceed 32 times the input size.
Affected products
- GPAC GPAC up to 26.02.0
Timeline
- 2026-05-28: disclosed: Issue reported on GitHub
- 2026-06-01: patched: Fix merged into master branch
- 2026-06-29: advisory: CVE published