CVE-2026-109827: GPAC AIT Parser Buffer Overflow Vulnerability

CVE-2026-109827 Overview

CVE-2026-109827 is an out-of-bounds write vulnerability in GPAC multimedia framework versions up to 26.07.0. The flaw resides in the gf_m2ts_decode_ait function within src/media_tools/ait.c, which is part of the Application Information Table (AIT) parser component. An attacker can trigger memory corruption by supplying a crafted MPEG-2 Transport Stream containing an excessive number of application descriptors. The vulnerability can be exploited remotely, though user interaction is required to process the malicious media. A public proof-of-concept exists, and the issue is tracked under [CWE-119].

Critical Impact
Processing a malicious MPEG-TS file causes an out-of-bounds write in the AIT parser, potentially leading to memory corruption and limited impact to confidentiality, integrity, and availability.

Affected Products

GPAC multimedia framework versions up to and including 26.07.0
The gf_m2ts_decode_ait function in src/media_tools/ait.c
Any application linking GPAC's MPEG-2 TS AIT parsing component

Discovery Timeline

2026-10-13 - CVE-2026-109827 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109827

Vulnerability Analysis

The vulnerability resides in GPAC's parsing of the Application Information Table (AIT), a structure used in MPEG-2 Transport Streams for signaling interactive TV applications. The gf_m2ts_decode_ait function iterates through application descriptors in a loop bounded by application_descriptors_loop_length but does not validate the index index_app_desc_id against the fixed-size array application_descriptors_id. A specially crafted AIT section with more descriptors than the array can hold writes beyond the allocated buffer. Successful exploitation requires the victim to open or process the malicious stream, classifying this as a user-interaction attack path.

Root Cause

The root cause is missing bounds validation on an array index. The parser trusts the descriptor count encoded in the AIT without comparing index_app_desc_id against GF_ARRAY_LENGTH(application->application_descriptors_id) before writing. This classic violation of memory boundary enforcement is categorized under [CWE-119], Improper Restriction of Operations within the Bounds of a Memory Buffer.

Attack Vector

An attacker crafts an MPEG-2 Transport Stream containing an AIT section with an oversized application_descriptors_loop_length and a correspondingly large number of application descriptors. When a user plays or demuxes the file through GPAC-based tools such as MP4Box or gpac, the parser writes past the fixed descriptor array. The attack is network-reachable because malicious streams can be delivered through web content, downloaded media, or streaming endpoints.

 		nb_of_protocol = 0;
 
 		while (app_desc_data_shift< application->application_descriptors_loop_length) {
-			u8 temp_descriptor_tag = gf_bs_read_int(bs,8);
+			u8 temp_descriptor_tag;
+			if (application->index_app_desc_id >= GF_ARRAY_LENGTH(application->application_descriptors_id)) {
+				GF_LOG(GF_LOG_WARNING, GF_LOG_CONTAINER, ("[Process AIT] Too many application descriptors, skipping %d remaining bytes\n", application->application_descriptors_loop_length - app_desc_data_shift));
+				gf_bs_skip_bytes(bs, application->application_descriptors_loop_length - app_desc_data_shift);
+				break;
+			}
+			temp_descriptor_tag = gf_bs_read_int(bs,8);
 			switch (temp_descriptor_tag) {
 			case APPLICATION_DESCRIPTOR:
 			{

Source: GPAC Commit 6d2c21a. The patch introduces an explicit index check before reading the next descriptor tag and gracefully skips remaining bytes when the array is full.

Detection Methods for CVE-2026-109827

Indicators of Compromise

Unexpected crashes or abnormal termination of processes linking the GPAC library when processing MPEG-TS content
Media files containing AIT sections with abnormally large application_descriptors_loop_length fields
Presence of files matching the published proof-of-concept archive referenced in VulDB CVE-2026-109827

Detection Strategies

Scan file repositories and content delivery pipelines for GPAC binaries at or below version 26.07.0
Inspect transport streams with MPEG-TS validators to flag malformed AIT descriptor counts before processing
Review build systems and container images for vendored copies of GPAC source referencing the unpatched ait.c

Monitoring Recommendations

Enable crash telemetry and core dump collection on hosts running GPAC-based media workflows
Alert on process termination signals from MP4Box, gpac, or applications that embed libgpac
Monitor outbound requests retrieving .ts, .m2ts, or .mpg files from untrusted sources

How to Mitigate CVE-2026-109827

Immediate Actions Required

Upgrade GPAC to a build that includes commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4 from the GPAC repository
Rebuild and redistribute any downstream applications that statically link vulnerable versions of libgpac
Restrict GPAC processing of transport streams to trusted sources until patches are deployed

Patch Information

The official fix is tracked in GPAC Pull Request #3932 and merged as commit 6d2c21a1a688abb20d0111b608db3b6f44d348f4. The related issue is GPAC Issue #3930. The patch adds an index bounds check against GF_ARRAY_LENGTH(application->application_descriptors_id) and skips remaining bytes safely when the descriptor array is full.

Workarounds

Disable or avoid parsing MPEG-2 Transport Stream AIT sections where possible in media pipelines
Run GPAC-based tooling inside sandboxed containers with restricted filesystem and network access to contain memory corruption
Reject untrusted MPEG-TS content at ingress using transport stream validators that enforce AIT size limits

bash

# Build GPAC from the patched source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 6d2c21a1a688abb20d0111b608db3b6f44d348f4
./configure
make -j$(nproc)
sudo make install