Executive brief
GPAC is a popular open-source multimedia framework used for video streaming, transcoding, and packaging. A heap-based buffer overflow vulnerability exists in its MPEG video reframing component, which could allow remote attackers to crash the application or potentially execute arbitrary code by sending a specially crafted video file.
Technical details
The vulnerability is a heap-based buffer overflow in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The attack is network-accessible and requires no authentication or user interaction beyond processing a malicious MPEG video file. An attacker can trigger memory corruption by providing a crafted MPEG video stream, potentially leading to denial of service or code execution. The issue has been patched in version abi-16.23 via commit afca1f1181668d85941d51ed1adf647807d5d975, and upgrading is recommended.
Affected products
- GPAC Project GPAC up to f1219cde
Timeline
- 2026-09-15: disclosed
- 2026-07-27: patched: Patch commit afca1f1181668d85941d51ed1adf647807d5d975