Executive brief
GPAC is an open-source multimedia framework used to process audio and video files. A buffer overflow vulnerability in its JPEG-2000 decoder allows an attacker to crash the application or potentially execute arbitrary code by providing a specially crafted JP2 file. This could impact any service or application using GPAC to decode multimedia content.
Technical details
A heap buffer overflow exists in the j2kdec_process() function in src/filters/dec_j2k.c when processing JPEG-2000 (JP2) files. The vulnerability occurs because the output buffer size is calculated based on dimensions read from the IHDR box at line 402, but when a crafted JP2 file declares small dimensions in the IHDR box (e.g., 1×1) while the JPEG-2000 codestream's SIZ marker declares large dimensions (e.g., 4000×4000), the opj_decode() function produces pixel data at the codestream's actual resolution. The code then writes this large pixel data (~48MB) to a tiny buffer (~3 bytes), causing a heap overflow. The dimensions are updated later (lines 435-441) but the out_size is never recalculated. The vulnerability requires only providing a malicious JP2 file as input; no authentication or prior access is required. A proof-of-concept confirms the crash. The fix (commit 9a253a07fd3f6b48022bba74302bf39388dda859) moves the out_size calculation after dimension updates.
Affected products
- GPAC GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and likely earlier
Timeline
- 2026-06-11: disclosed: Vulnerability reported in GitHub issue #3613
- 2026-09-09: patched: Fixed in commit 9a253a07fd3f6b48022bba74302bf39388dda859
- 2026-09-09: advisory: CVE-2026-71613 published