Executive brief
A vulnerability exists in GPAC, a popular open-source multimedia framework used for video streaming and delivery. By providing a specially crafted subtitle file (.idx), an attacker can cause the MP4Box tool or GPAC player to crash. This could lead to a denial-of-service, interrupting media processing workflows or crashing the application for the user.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in the vobsub_read_idx function within /src/media_tools/vobsub.c. The root cause is a logic mismatch where the num_langs counter is incremented without bounds while the underlying langs array is fixed at 32 entries. An attacker can trigger this by providing a VobSub .idx file containing more than 32 'id:' declarations. When the demuxer later iterates through the language list in vobsubdmx_parse_idx, it reads past the end of the fixed array, leading to a segmentation fault or heap-buffer-overflow. The issue has been addressed in commits 5320970 and aa0fb77 by implementing a MIN check against the array length and improving error handling.
Affected products
- GPAC GPAC 26.03-DEV
Timeline
- 2026-06-08: disclosed: Issue reported on GitHub
- 2026-07-09: advisory: NVD publication date
- 2026-07-09: patched: Fixes identified in commits 5320970 and aa0fb77
References
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/commit/532097084729a936bcdf6a27c41003f3bd7dc3ff
- https://github.com/gpac/gpac/commit/aa0fb77b82e51b159a2024c440cdf6b571b14d81
- https://github.com/gpac/gpac/issues/3611
- https://vuldb.com/cve/CVE-2026-15185
- https://vuldb.com/submit/851214
- https://vuldb.com/vuln/377111