GPAC vulnerabilities

A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.

A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.

A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.

GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.

Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function.

A NULL pointer dereference vulnerability exists in the smooth_parse_stream_index() function in src/media_tools/mpd.c of GPAC. The issue is fixed in commit b35c61f104b85fbb16520ac2838d5d2ef70845b5.

A vulnerability was found in GPAC up to b40ce70f5 in the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the MP4Box component. Manipulation of the data argument leads to a heap-based buffer overflow. Local access is required and the exploit is publicly available.

A vulnerability was found in GPAC up to version 2.5-DEV in the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c in the MP4Box component. Manipulation of the nalu_out_bs argument causes a double free. The attack can be performed locally and the exploit has been publicly disclosed.

A security vulnerability was detected in GPAC 26.03-DEV-rev342-g80071f700-master in the function txtin_probe_duration of the file src/filters/load_text.c of the TeXML File Handler component. Manipulation of the argument txml_timescale leads to a divide by zero. The attack requires local access.

A flaw in GPAC 26.02.0 affects the nhmldump_send_frame function in src/filters/write_nhml.c of the Media File Handler component, leading to a null pointer dereference. The attack requires local access and an exploit has been published.

A weakness in the ISOBMFF Parser component of GPAC up to version 26.02.0 affects the file src/utils/base_encoding.c. A local attacker can trigger manipulation leading to highly compressed data, potentially causing uncontrolled data expansion after decompression. A public exploit increases the risk of attacks.

A use-after-free vulnerability was found in the GPAC/MP4Box library before version 26.02.0 in the gf_filter_pid_inst_swap_delete_task function within filter_pid.c. An attacker can exploit this by supplying a crafted media file to cause a denial of service (DoS).

A use-after-free vulnerability was found in the GPAC/MP4Box library before version 26.02.0 in the gf_filter_pid_reconfigure_task_discard function in filter_pid.c. An attacker can cause a Denial of Service (DoS) by supplying a crafted media file.

GPAC MP4Box version 2.4 contains a floating point exception in the gf_opus_parse_packet_header function. Attackers can exploit this to cause a Denial of Service (DoS) via a crafted MP4 file.

Vulnerability in GPAC MP4Box v2.4: NULL pointer dereference in gf_odf_vvc_cfg_write_bs function (odf/descriptors.c). An attacker can cause a Denial of Service (DoS) by supplying a crafted MP4 file.

GPAC MP4Box version 2.4 has a null pointer dereference in gf_isom_get_user_data_count (isomedia/isom_read.c). An attacker can supply a crafted MP4 file causing a crash (DoS).

Vulnerability in GPAC MP4Box v2.4: segmentation violation in gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c). An attacker can cause a Denial of Service (DoS) by supplying crafted HEVC SPS data.

A segmentation violation in the gf_media_get_color_info function in GPAC/MP4Box before version 26.02.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted data file.

A heap use-after-free in the dasher_process function in GPAC/MP4Box before version 26.02.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MPEG-2 file.

In GPAC up to version 2.4.0, the function Media_GetSample in file src/isomedia/media.c of the MP4Box component causes a memory leak when manipulating the 'cat' argument. The attack requires local access, and the exploit has been publicly disclosed.

Vulnerability in GPAC up to version 2.4.0 in the MergeFragment function of src/isomedia/isom_intern.c in the MP4Box component causes a null pointer dereference via a local attack. Exploit has been published.

GPAC v2.3-DEV-rev449-g5948e4f70-master was found to contain a heap-use-after-free vulnerability in the gf_bs_align function at bitstream.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a crafted file.

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the BM_ParseIndexValueReplace function at /lib/libgpac.so.

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_isom_remove_user_data function at /lib/libgpac.so.

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the gf_dump_vrml_sffield function at /lib/libgpac.so.

GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a segmentation violation in the dump_isom_scene function at /mp4box/filedump.c.