Executive brief
GPAC is a multimedia framework used for processing video, audio, and SVG content. A buffer overflow vulnerability in the SVG name processing function allows an attacker to crash the application or potentially execute arbitrary code by providing SVG files with excessively long element names, impacting availability and potentially enabling remote code execution if the SVG generator is exposed to untrusted input.
Technical details
The vulnerability is a classic buffer overflow (CWE-787) in the svgNameToImplementationName() function within applications/generators/SVG/main.c. The function copies an XML-provided SVG element/attribute name into a fixed 50-byte destination buffer using strcpy() without length validation, then scans the buffer with strchr() to replace certain characters. An attacker can craft an SVG file with a name longer than 50 bytes to overflow the stack or heap buffer, corrupting adjacent memory. Subsequent strchr() calls may perform out-of-bounds reads (CWE-125) while searching for delimiters. The attack requires providing a malicious SVG file to the generator; no authentication is needed. Impact ranges from denial of service (crash) to potential code execution depending on compiler flags and memory layout.
Affected products
- GPAC GPAC commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 and likely earlier versions
Timeline
- 2026-05-19: disclosed: Issue opened on GitHub describing the buffer overflow in svgNameToImplementationName()
- 2026-08-25: advisory: CVE-2026-52489 published