CVE-2026-91086
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A heap-based buffer overflow has been detected in GPAC in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The vulnerability can be exploited remotely and a public exploit is available. The issue is fixed in version abi-16.23.
Risk Assessment
A remote attacker could trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or application crash when processing untrusted video files. Since the exploit is public, the risk is high.
Recommendation
Upgrade GPAC to version abi-16.23 or later (patch afca1f1181668d85941d51ed1adf647807d5d975). Until then, avoid processing untrusted MPEG files.
Other vulnerabilities in GPAC
See all- CVE-2026-92474Low
A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.
- CVE-2026-92472Low
A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2021-4043Medium
NULL pointer dereference vulnerability in the GitHub repository gpac/gpac prior to 1.1.0. It may cause an application crash when processing crafted data.
- CVE-2026-124031Medium
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that cast a Shape's appearance node to M_Appearance without checking its node tag. An attacker can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field, triggering an invalid memory read and crashing MP4Box.
- CVE-2026-124030Medium
GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. An attacker can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.
Original NVD description (English source)
A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS