CVE-2026-39103: GPAC Buffer Overflow DoS Vulnerability

CVE-2026-39103 Overview

CVE-2026-39103 is a heap buffer overflow vulnerability in GPAC, an open-source multimedia framework used for processing MPEG, ISO, and SVG content. The flaw resides in src/scenegraph/svg_attributes.c, specifically within the svg_parse_strings() function called by gf_svg_parse_attribute(). An attacker can trigger the overflow by supplying a crafted SVG attribute, leading to denial of service. The vulnerability affects GPAC versions prior to commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702. Exploitation requires local access and user interaction, such as opening a malicious media file. The issue is tracked under [CWE-122: Heap-based Buffer Overflow].

Critical Impact
Crafted SVG input can crash GPAC processes, denying service to applications that rely on the framework for multimedia parsing.

Affected Products

GPAC multimedia framework before commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702
The svg_parse_strings() parser in src/scenegraph/svg_attributes.c
Applications and tools embedding vulnerable GPAC builds for SVG attribute parsing

Discovery Timeline

2026-05-05 - CVE-2026-39103 published to NVD
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-39103

Vulnerability Analysis

The vulnerability stems from improper boundary checking inside svg_parse_strings() when iterating over SVG attribute string tokens. The parser advances a sep pointer through input separated by spaces, semicolons, and commas. The original loop condition checked only whether sep was non-null but failed to verify that sep[0] was non-zero. When the parser reached the terminating null byte, the loop continued reading past the end of the buffer. This out-of-bounds read corrupts adjacent heap memory and triggers a process crash. Because the function is reached through gf_svg_parse_attribute(), any SVG content processed by GPAC can serve as the trigger.

Root Cause

The root cause is a missing null-terminator check in a tokenization loop. The patched code adds an explicit !sep[0] test to break the loop when the buffer ends, preventing the heap overflow described in [CWE-122].

Attack Vector

An attacker crafts an SVG file or stream with malformed string attributes and delivers it to a user running a GPAC-based tool such as MP4Box or a player linking the library. The user opens the file, the parser reaches the terminating byte without breaking, and the process reads beyond the allocated heap chunk. Network-based exploitation is not required because the attack vector is local with user interaction.

// Patch from src/scenegraph/svg_attributes.c - svg_parse_strings()
 while (1) {
 	while (sep && sep[0]==' ') sep++;
-	if (!sep) break;
+	if (!sep || !sep[0]) break;
 	next = sep+1;
 	while (next[0]) {
 		if (strchr(" ;,", next[0])) break;

Source: GPAC commit 391dc7f

Detection Methods for CVE-2026-39103

Indicators of Compromise

Unexpected crashes of MP4Box, gpac, or other GPAC-linked binaries when opening SVG or scene description content
Core dumps showing faulting addresses inside svg_parse_strings or gf_svg_parse_attribute
AddressSanitizer or heap-checker reports flagging out-of-bounds reads in src/scenegraph/svg_attributes.c

Detection Strategies

Inventory hosts running GPAC and verify build commits against 391dc7f4d234988ea0bc3cc294eb725eddf8f702 or later
Run fuzzing harnesses against gf_svg_parse_attribute() using malformed SVG token strings to confirm patch status
Monitor endpoint telemetry for repeated abnormal terminations of multimedia parsing processes following user file opens

Monitoring Recommendations

Enable process crash logging on workstations and analysis sandboxes that handle untrusted multimedia files
Track the GitHub issue discussion for updated fuzzing test cases and reproducers
Alert on the execution of GPAC binaries with file inputs originating from email attachments or downloads

How to Mitigate CVE-2026-39103

Immediate Actions Required

Rebuild GPAC from source at commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702 or a later release that includes the fix
Restrict GPAC tool execution to trusted SVG and multimedia content until patched binaries are deployed
Distribute updated packages to all systems where users open multimedia files with GPAC components

Patch Information

The maintainers fixed the issue in GPAC commit 391dc7f by adding the missing !sep[0] boundary check in svg_parse_strings(). Downstream distributions should backport this commit to any packaged GPAC version. Reference the GitHub Issue 3506 discussion for the original fuzzing report.

Workarounds

Avoid opening untrusted SVG files or scene descriptions in GPAC-based applications until the patch is applied
Run GPAC tools inside a sandbox or container so that crashes do not affect the host environment
Disable automatic file association between SVG content and GPAC binaries on shared workstations

bash

# Build GPAC from the patched commit
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 391dc7f4d234988ea0bc3cc294eb725eddf8f702
./configure && make -j$(nproc) && sudo make install
gpac -version