CVE-2026-33144: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-33144 Overview

A heap-based buffer overflow (write) vulnerability has been discovered in GPAC MP4Box, an open-source multimedia framework widely used for media processing and manipulation. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function located in utils/xml_bin_custom.c when processing crafted NHML files containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap that could lead to application crashes or potential code execution.

Critical Impact

Successful exploitation of this heap-based buffer overflow could allow attackers to corrupt heap memory, potentially leading to denial of service or arbitrary code execution when users process malicious NHML multimedia files.

Affected Products

• GPAC MP4Box versions prior to commit 86b0e36
• GPAC multimedia framework installations using vulnerable XML parsing functionality
• Applications integrating GPAC libraries for NHML file processing

Discovery Timeline

• 2026-03-20 - CVE-2026-33144 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33144

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption flaw that occurs when the application writes data past the allocated boundaries of a buffer in heap memory. The vulnerable code path is triggered during NHML file parsing, specifically when the gf_xml_parse_bit_sequence_bs function processes <BS> (BitSequence) elements.

The local attack vector requires user interaction, meaning an attacker must convince a victim to open or process a malicious NHML file using GPAC MP4Box. While this reduces the attack surface compared to network-exploitable vulnerabilities, media processing tools frequently handle untrusted files from various sources, making this a realistic attack scenario.

The impact includes potential loss of confidentiality and integrity through memory corruption, as well as high availability impact due to application crashes.

Root Cause

The root cause lies in insufficient bounds checking within the gf_xml_parse_bit_sequence_bs function when processing BitSequence elements in NHML files. The function fails to properly validate the size or content of <BS> elements before writing parsed data to heap-allocated buffers, allowing malformed input to trigger writes beyond allocated memory regions.

Attack Vector

The attack requires local access where an attacker crafts a malicious NHML (MPEG-4 Hint Track Markup Language) file containing specially constructed <BS> BitSequence elements. When a user processes this file with GPAC MP4Box or any application using the vulnerable GPAC library functions, the parser writes data beyond the bounds of heap-allocated buffers.

The exploitation scenario typically involves:

1. Attacker creates a malicious NHML file with crafted <BS> elements designed to overflow heap buffers
2. The malicious file is delivered to a victim through email attachments, downloads, or file sharing
3. Victim opens or processes the file using GPAC MP4Box or integrated applications
4. The vulnerable gf_xml_parse_bit_sequence_bs function processes the malicious elements
5. Out-of-bounds heap write occurs, potentially corrupting adjacent memory structures

For detailed technical analysis of the vulnerable code and the fix, refer to the GitHub Security Advisory GHSA-3jw5-9pmw-vmfg.

Detection Methods for CVE-2026-33144

Indicators of Compromise

• Unexpected crashes or segmentation faults in MP4Box or GPAC-based applications during NHML file processing
• Abnormal memory consumption patterns when parsing multimedia files
• Core dumps indicating heap corruption in the gf_xml_parse_bit_sequence_bs function or xml_bin_custom.c module
• Suspicious NHML files with unusually large or malformed <BS> elements

Detection Strategies

• Deploy endpoint detection and response (EDR) solutions like SentinelOne to monitor for exploitation attempts and memory corruption behaviors
• Implement file integrity monitoring on systems that process multimedia content
• Configure application-level logging to capture NHML parsing errors and exceptions
• Use memory safety tools such as AddressSanitizer in development and testing environments to detect heap overflows

Monitoring Recommendations

• Monitor MP4Box and GPAC-based application process behaviors for signs of memory corruption or unexpected termination
• Enable verbose logging for multimedia processing workflows to identify anomalous file inputs
• Review incoming NHML files in media processing pipelines for suspicious characteristics before processing
• Implement sandboxing for multimedia file processing to contain potential exploitation attempts

How to Mitigate CVE-2026-33144

Immediate Actions Required

• Update GPAC to a version that includes commit 86b0e36 or later immediately
• Audit systems to identify all instances of GPAC MP4Box installations and libraries
• Restrict NHML file processing to trusted sources until patches are applied
• Implement strict input validation for multimedia files entering processing pipelines

Patch Information

The vulnerability has been addressed via commit 86b0e36ea4c71402fbdaf7e13d73ba8841003e72 in the GPAC repository. Organizations should update to a GPAC version that includes this fix. The patch can be reviewed at the GitHub Commit Update.

For detailed information about the vulnerability and remediation guidance, consult the GitHub Security Advisory GHSA-3jw5-9pmw-vmfg.

Workarounds

• Avoid processing NHML files from untrusted or unknown sources until the patch is applied
• Implement application sandboxing to isolate MP4Box and GPAC processes from critical system resources
• Use containerization or virtual environments for multimedia file processing workflows
• Consider temporarily disabling NHML file processing functionality if not required for operations

# Verify GPAC version and check for vulnerable installations
gpac -version
mp4box -version

# Update GPAC from source with the security fix
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 86b0e36ea4c71402fbdaf7e13d73ba8841003e72
./configure
make
sudo make install