Executive brief
GPAC is an open-source multimedia framework used to process audio and video files. A vulnerability in its HTTP client allows a remote attacker to crash the application by sending a maliciously crafted HTTP response with a specially formatted chunk size, causing denial of service. An attacker could exploit this by hosting a malicious HTTP server or intercepting HTTP traffic to trigger the crash.
Technical details
An out-of-bounds read vulnerability exists in the gf_dm_data_received and gf_dm_get_chunk_data functions in src/utils/downloader.c. When processing a Transfer-Encoding: chunked HTTP response, the code parses the chunk size using sscanf("%x", &size) without validating the upper bound. A crafted first chunk size of 0xFFFFFFFF (4GB-1) bypasses a subsequent bounds check due to unsigned 32-bit integer wraparound: when hdr_size + 0xFFFFFFFF is computed, the result wraps to a small value, allowing nbBytes to remain 0xFFFFFFFF. This causes a subsequent memcpy to attempt reading 4GB-1 bytes from a ~4KB heap buffer, triggering an out-of-bounds read. The vulnerability is reached when the GPAC client connects to any HTTP URL, including DASH manifest segments. A fix is available in commit 2fd5a06.
Affected products
- GPAC GPAC v26.07.0
Timeline
- 2026-08-19: disclosed: Vulnerability reported via GitHub issue
- 2026-09-09: patched: Fixed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640