Is CVE-2026-52489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52489 being exploited in the wild.

How severe is CVE-2026-52489?

High severity, with a CVSS score of 7.8, published 25 August 2026.

Which products and versions are affected?

Gpac commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 and likely earlier versions.

Is there a fix for CVE-2026-52489?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52489 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-52489?

Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52489: GPAC buffer overflow in SVG name handling

CVE-2026-52489 · Severity: high · CVSS 7.8 · Published 2026-08-25

GPAC is a multimedia framework used for processing video, audio, and SVG content. A buffer overflow vulnerability in the SVG name processing function allows an attacker to crash the application or potentially execute arbitrary code by providing SVG files with excessively long element names, impacting availability and potentially enabling remote code execution if the SVG generator is exposed to untrusted input.

Technologies: Gpac. Vendors: Gpac.

Quick answers

Is CVE-2026-52489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52489 being exploited in the wild.
How severe is CVE-2026-52489?: High severity, with a CVSS score of 7.8, published 25 August 2026.
Which products and versions are affected?: Gpac commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 and likely earlier versions.
Is there a fix for CVE-2026-52489?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52489 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-52489?: Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic buffer overflow (CWE-787) in the svgNameToImplementationName() function within applications/generators/SVG/main.c. The function copies an XML-provided SVG element/attribute name into a fixed 50-byte destination buffer using strcpy() without length validation, then scans the buffer with strchr() to replace certain characters. An attacker can craft an SVG file with a name longer than 50 bytes to overflow the stack or heap buffer, corrupting adjacent memory. Subsequent strchr() calls may perform out-of-bounds reads (CWE-125) while searching for delimiters. The attack requires providing a malicious SVG file to the generator; no authentication is needed. Impact ranges from denial of service (crash) to potential code execution depending on compiler flags and memory layout.

Affected products

GPAC GPAC commit 31becc9e08b88e525a4a62013a4000de1c0f8fd9 and likely earlier versions

Timeline

2026-05-19: disclosed: Issue opened on GitHub describing the buffer overflow in svgNameToImplementationName()
2026-08-25: advisory: CVE-2026-52489 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.