Executive brief
GPAC is an open-source multimedia framework used for processing digital media and streaming content. A format string vulnerability in the route parsing module allows an attacker to send a specially crafted media stream over the network that causes the application to crash, disrupting media processing operations. This can be exploited remotely without authentication to create a denial-of-service condition.
Technical details
A format string vulnerability exists in the gf_route_media_complete_object() function in src/media_tools/route_dmx.c (line 969), where a user-controlled format string (toi_template) derived from an FDT-Instance XML element's fileTemplate attribute is passed directly to sprintf() without sanitization. An attacker can inject format string specifiers like %n into the fileTemplate field of an ROUTE STSID descriptor, which propagates through the template processing and allows arbitrary write operations via sprintf. The attack is triggered by sending ALC/LCT UDP packets to the routein filter. While practical exploitation for code execution is limited on modern x86-64 systems with full RELRO and PIE due to address space constraints (writes restricted to low 4GB), the vulnerability reliably causes a crash (SEGV). The vulnerability affects GPAC at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and likely earlier versions; a fix was applied in commit 3c4e6c5b3e0c6fa9b16d55599701a08354538fab.
Affected products
- GPAC GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and likely earlier
Timeline
- 2026-06-12: disclosed
- 2026: patched: Fix applied in commit 3c4e6c5b3e0c6fa9b16d55599701a08354538fab
- 2026-09-09: advisory