Executive brief
GPAC is a widely-used multimedia framework for video streaming and transcoding. A heap buffer overflow in its WebSocket message handler allows remote attackers to trigger memory corruption by sending a specially crafted WebSocket frame. Successful exploitation could lead to application crash, information disclosure, or arbitrary code execution.
Technical details
A heap-based buffer overflow vulnerability exists in the rmt_client_handle_ws_frame function of src/utils/rmt_ws.c in GPAC version 26.07.0. The vulnerability is triggered by manipulation of the payload_size argument, which is not properly validated before being used in buffer operations. The attack is remotely exploitable without authentication, requiring only network access to a service using the vulnerable WebSocket handler. An attacker can craft and send a malicious WebSocket frame to trigger the overflow, potentially achieving code execution or denial of service. The issue is fixed in version abi-16.26 by commit 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12.
Affected products
- GPAC GPAC 26.07.0
Timeline
- 2026-09-16: disclosed