Executive brief
GPAC is an open-source multimedia framework used for processing and packaging video and audio content. A vulnerability in its SVG image parsing component allows a specially crafted file to crash the application. If an attacker can convince a user to open a malicious SVG file, it could lead to a denial-of-service, disrupting operations or crashing media processing services.
Technical details
A heap-based buffer overflow exists in GPAC's SVG parser within the `svg_parse_strings()` function in `src/scenegraph/svg_attributes.c`. The vulnerability is triggered when the parser fails to properly validate boundaries while iterating through string separators in SVG attributes. An attacker can exploit this by providing a crafted SVG file that causes an out-of-bounds read/write on the heap during the SAX parsing process. This typically results in an application crash (Denial of Service). The issue was fixed in commit 391dc7f by adding explicit null-terminator and pointer checks during string tokenization.
Affected products
- GPAC GPAC before commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702
Timeline
- 2026-03-31: disclosed: Issue reported on GitHub by junius-sec
- 2026-04-01: patched: Fix committed to GPAC repository
- 2026-05-05: advisory: CVE-2026-39103 published