EUVD-2026-40020
GHSA-c4wq-769x-vwcv
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege input required; impact is limited to availability via resource exhaustion, with no confidentiality or integrity effects confirmed.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."
AnalysisAI
Unbounded zlib decompression in GPAC up to version 26.02.0 allows a local low-privileged attacker to cause resource exhaustion via a crafted highly-compressed (zip-bomb) payload processed by the ISOBMFF parser and associated filter modules. The affected function gf_gz_decompress_payload_ex() in src/utils/base_encoding.c applies no ceiling on inflated output size, enabling disproportionate memory or CPU consumption. A public proof-of-concept exists (GitHub issue #3588), but no active exploitation is confirmed in CISA KEV; the CVSS 4.0 score of 4.8 reflects the local-only attack surface and limited availability-only impact.
Technical ContextAI
GPAC is an open-source C-language multimedia framework for authoring, packaging, and streaming MPEG-4 and ISO Base Media File Format (ISOBMFF) content. The root cause maps to CWE-409 (Improper Handling of Highly Compressed Data), a class of vulnerabilities where decompression routines impose no upper bound on output size relative to input, enabling 'decompression bomb' attacks. The vulnerable code path centers on gf_gz_decompress_payload_ex() in src/utils/base_encoding.c, which wraps zlib's inflate routine. The same unbounded decompression pattern was replicated across multiple filter modules: src/filters/load_svg.c, src/filters/write_nhml.c, and src/filters/dmx_nhml.c, all of which shared the same unsafe inflate loop. The fix (commit 297f2d8d, PR #3589) introduces a global constant ZLIB_INFLATE_MAX_MULTIPLIER = 32 in include/gpac/setup.h and inserts a check in each inflate loop that aborts with GF_NON_COMPLIANT_BITSTREAM if d_stream.total_out / 32 > input_len. The vendor explicitly notes this multiplier may be tuned in future releases.
RemediationAI
Apply the upstream patch available at commit 297f2d8d1f493d8b241330533cd47f7da758aeb3 (https://github.com/gpac/gpac/commit/297f2d8d1f493d8b241330533cd47f7da758aeb3) via PR #3589 (https://github.com/gpac/gpac/pull/3589). An exact patched release version number is not independently confirmed - users should build from the patched commit or monitor the GPAC release channel for versions superseding 26.02.0. As a compensating control until patching is complete, restrict which users and processes may supply input files to GPAC-based pipelines, particularly blocking untrusted or externally-sourced compressed media content; this limits exposure but does not eliminate the vulnerability since any local user meeting the low-privilege threshold can still trigger it. For automated ingest pipelines, applying upstream file size limits at the ingestion boundary can bound the amplification risk by constraining the compressed input before GPAC processes it, though this is advisory-only and not a substitute for the vendor patch.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today