Is CVE-2026-71612 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71612 being exploited in the wild.

How severe is CVE-2026-71612?

High severity, with a CVSS score of 8.4, published 9 September 2026.

Which products and versions are affected?

Gpac prior to fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 (commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier).

Is there a fix for CVE-2026-71612?

A patch was published on 2026-09-09: Fix released in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71612 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-71612?

Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71612: GPAC buffer overflow in nhntdmx_process via long file path

CVE-2026-71612 · Severity: high · CVSS 8.4 · Published 2026-09-09

GPAC is an open-source multimedia framework used to process audio and video files. A stack buffer overflow in the NHNT (Networked Hint Track) file handler allows an attacker to crash the application or execute arbitrary code by providing a file with an excessively long path exceeding 1000 bytes. Exploitation requires only the ability to place a file at a crafted path or convince a user to open one.

Technologies: Gpac. Vendors: Gpac.

Quick answers

Is CVE-2026-71612 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71612 being exploited in the wild.
How severe is CVE-2026-71612?: High severity, with a CVSS score of 8.4, published 9 September 2026.
Which products and versions are affected?: Gpac prior to fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 (commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier).
Is there a fix for CVE-2026-71612?: A patch was published on 2026-09-09: Fix released in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71612 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-71612?: Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stack buffer overflow in the nhntdmx_process() function in dmx_nhnt.c. The root cause is a logic flaw in path validation: a 1000-byte stack buffer (szMedia) is initially filled safely using strncpy, but later the code uses an unsafe strcpy to re-copy the original untruncated file path into the buffer at line 379. The length check at line 323 operates on a strrchr-truncated version of the path (after extension removal), not the original path, rendering it ineffective. An attacker crafting a path longer than 1000 bytes with an early dot character (e.g., "a.bbb/d1/d2/...") bypasses validation and triggers overflow. The attack surface includes any use of GPAC's NHNT processing: the command-line tool, MP4Box, or applications using libgpac. The vulnerability was fixed in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 by replacing the unsafe strcpy with gf_strlcpy.

Affected products

GPAC GPAC prior to fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 (commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier)

Timeline

2026-06-09: disclosed: Issue #3612 opened on GitHub
2026-09-09: patched: Fix released in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6
2026-09-09: advisory: CVE-2026-71612 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.