CVE-2026-39103: GPAC Buffer Overflow DoS Vulnerability

CVE-2026-39103 Overview

CVE-2026-39103 is a heap buffer overflow vulnerability in GPAC, an open-source multimedia framework used for processing MPEG, ISO, and SVG content. The flaw resides in src/scenegraph/svg_attributes.c, specifically within the svg_parse_strings() function called by gf_svg_parse_attribute(). An attacker can trigger the overflow by supplying a crafted SVG attribute, leading to denial of service. The vulnerability affects GPAC versions prior to commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702. Exploitation requires local access and user interaction, such as opening a malicious media file. The issue is tracked under [CWE-122: Heap-based Buffer Overflow].

Critical Impact

Crafted SVG input can crash GPAC processes, denying service to applications that rely on the framework for multimedia parsing.

Affected Products

• GPAC multimedia framework before commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702
• The svg_parse_strings() parser in src/scenegraph/svg_attributes.c
• Applications and tools embedding vulnerable GPAC builds for SVG attribute parsing

Discovery Timeline

• 2026-05-05 - CVE-2026-39103 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-39103

Vulnerability Analysis

The vulnerability stems from improper boundary checking inside svg_parse_strings() when iterating over SVG attribute string tokens. The parser advances a sep pointer through input separated by spaces, semicolons, and commas. The original loop condition checked only whether sep was non-null but failed to verify that sep[0] was non-zero. When the parser reached the terminating null byte, the loop continued reading past the end of the buffer. This out-of-bounds read corrupts adjacent heap memory and triggers a process crash. Because the function is reached through gf_svg_parse_attribute(), any SVG content processed by GPAC can serve as the trigger.

Root Cause

The root cause is a missing null-terminator check in a tokenization loop. The patched code adds an explicit !sep[0] test to break the loop when the buffer ends, preventing the heap overflow described in [CWE-122].

Attack Vector

An attacker crafts an SVG file or stream with malformed string attributes and delivers it to a user running a GPAC-based tool such as MP4Box or a player linking the library. The user opens the file, the parser reaches the terminating byte without breaking, and the process reads beyond the allocated heap chunk. Network-based exploitation is not required because the attack vector is local with user interaction.

// Patch from src/scenegraph/svg_attributes.c - svg_parse_strings()
 while (1) {
 	while (sep && sep[0]==' ') sep++;
-	if (!sep) break;
+	if (!sep || !sep[0]) break;
 	next = sep+1;
 	while (next[0]) {
 		if (strchr(" ;,", next[0])) break;

Source: GPAC commit 391dc7f

Detection Methods for CVE-2026-39103

Indicators of Compromise

• Unexpected crashes of MP4Box, gpac, or other GPAC-linked binaries when opening SVG or scene description content
• Core dumps showing faulting addresses inside svg_parse_strings or gf_svg_parse_attribute
• AddressSanitizer or heap-checker reports flagging out-of-bounds reads in src/scenegraph/svg_attributes.c

Detection Strategies

• Inventory hosts running GPAC and verify build commits against 391dc7f4d234988ea0bc3cc294eb725eddf8f702 or later
• Run fuzzing harnesses against gf_svg_parse_attribute() using malformed SVG token strings to confirm patch status
• Monitor endpoint telemetry for repeated abnormal terminations of multimedia parsing processes following user file opens

Monitoring Recommendations

• Enable process crash logging on workstations and analysis sandboxes that handle untrusted multimedia files
• Track the GitHub issue discussion for updated fuzzing test cases and reproducers
• Alert on the execution of GPAC binaries with file inputs originating from email attachments or downloads

How to Mitigate CVE-2026-39103

Immediate Actions Required

• Rebuild GPAC from source at commit 391dc7f4d234988ea0bc3cc294eb725eddf8f702 or a later release that includes the fix
• Restrict GPAC tool execution to trusted SVG and multimedia content until patched binaries are deployed
• Distribute updated packages to all systems where users open multimedia files with GPAC components

Patch Information

The maintainers fixed the issue in GPAC commit 391dc7f by adding the missing !sep[0] boundary check in svg_parse_strings(). Downstream distributions should backport this commit to any packaged GPAC version. Reference the GitHub Issue 3506 discussion for the original fuzzing report.

Workarounds

• Avoid opening untrusted SVG files or scene descriptions in GPAC-based applications until the patch is applied
• Run GPAC tools inside a sandbox or container so that crashes do not affect the host environment
• Disable automatic file association between SVG content and GPAC binaries on shared workstations

# Build GPAC from the patched commit
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 391dc7f4d234988ea0bc3cc294eb725eddf8f702
./configure && make -j$(nproc) && sudo make install
gpac -version