CVE-2026-7135: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-7135 Overview

A security flaw has been discovered in GPAC up to version 26.03-DEV-rev105-g8f39a1eb3-master. This vulnerability affects the function elng_box_read within the file src/isomedia/box_code_base.c of the MP4Box component. By manipulating the elng argument, an attacker can trigger an out-of-bounds read condition. This is a local attack vector vulnerability that requires the attacker to have local access to the system. An exploit has been released publicly and may be used for attacks. The vulnerability has been addressed through commit cf6ac48c972eaaee2af270adc3f36615325deb3e.

Critical Impact

Local attackers can exploit integer overflow issues in the GPAC MP4Box component to trigger out-of-bounds read conditions, potentially leading to information disclosure or application crashes.

Affected Products

• GPAC up to version 26.03-DEV-rev105-g8f39a1eb3-master
• MP4Box component (Extended Language Box handling)
• Systems processing untrusted MP4/ISO media files with GPAC

Discovery Timeline

• 2026-04-27 - CVE CVE-2026-7135 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7135

Vulnerability Analysis

This vulnerability is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw exists in the Extended Language Box (elng) parsing functionality within GPAC's ISO media file handling code. When processing specially crafted MP4 files, the elng_box_read function fails to properly validate the size parameter before performing memory operations, leading to an out-of-bounds read condition.

The vulnerability allows local attackers to potentially read memory beyond allocated buffer boundaries, which could result in information disclosure or application denial of service through crashes. The attack requires local access and user interaction to process a malicious media file.

Root Cause

The root cause is an integer overflow vulnerability in the box size handling within src/isomedia/box_code_base.c. The code did not properly validate that ptr->size does not exceed GF_UINT_MAX before using it for memory allocation operations. Additionally, related integer overflow issues in src/isomedia/isom_intern.c involve time calculation operations that could overflow when computing media time increments.

Attack Vector

The attack requires local access to the target system. An attacker must craft a malicious MP4 file with manipulated Extended Language Box (elng) data and convince a user to process this file using GPAC's MP4Box tool. The manipulation of the size parameter triggers the out-of-bounds read when the file is parsed.

// Security patch in src/isomedia/box_code_base.c
// Source: https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e
 {
 	GF_ExtendedLanguageBox *ptr = (GF_ExtendedLanguageBox *)s;
 
+	if (ptr && ptr->size > GF_UINT_MAX)
+		return GF_ISOM_INVALID_FILE;
+
 	if (ptr->size) {
 		ptr->extended_language = (char*)gf_malloc((u32) ptr->size);
 		if (ptr->extended_language == NULL) return GF_OUT_OF_MEM;

// Security patch in src/isomedia/isom_intern.c
// Source: https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e
 	}
 
 	/*WARNING: this can be "-1" when doing searchForward mode (to prevent jumping to next entry)*/
-	mtime = ent->mediaTime + movieTime - (time * trak->Media->mediaHeader->timeScale / trak->moov->mvhd->timeScale);
+	s64 mediaTime_increment = movieTime - (time * trak->Media->mediaHeader->timeScale / trak->moov->mvhd->timeScale);
+	if (ent->mediaTime > GF_INT64_MAX - mediaTime_increment)
+		return GF_ISOM_INVALID_FILE;
+	mtime = ent->mediaTime + mediaTime_increment;
 	if (mtime<0) mtime = 0;
 	*MediaTime = (u64) mtime;
 	*MediaOffset = ent->mediaTime;

Detection Methods for CVE-2026-7135

Indicators of Compromise

• Unexpected crashes or segmentation faults in MP4Box or GPAC-based applications
• Malformed MP4 files with abnormally large Extended Language Box (elng) size values
• Memory access violations logged during media file processing
• Unusual MP4 files with integer overflow-inducing size parameters in box headers

Detection Strategies

• Monitor for MP4Box process crashes with memory access violation errors
• Implement file integrity monitoring for media processing pipelines
• Use memory sanitizers (AddressSanitizer, Valgrind) during development and testing to detect out-of-bounds reads
• Deploy application-level logging to capture malformed media file processing attempts

Monitoring Recommendations

• Enable verbose logging for GPAC/MP4Box operations to capture parsing errors
• Monitor system logs for repeated application crashes related to media processing
• Implement input validation on media files before processing with GPAC components
• Consider sandboxing media processing operations to limit impact of exploitation

How to Mitigate CVE-2026-7135

Immediate Actions Required

• Update GPAC to a version containing the security fix (commit cf6ac48c972eaaee2af270adc3f36615325deb3e or later)
• Avoid processing untrusted MP4 files with vulnerable GPAC versions
• Implement input validation to reject malformed media files before processing
• Consider running MP4Box in a sandboxed environment to limit potential impact

Patch Information

The vulnerability has been patched in the GPAC repository. The fix is available in commit cf6ac48c972eaaee2af270adc3f36615325deb3e. The patch adds proper bounds checking for the ptr->size value against GF_UINT_MAX before memory allocation and includes overflow protection for media time calculations. Users should update to a GPAC release that includes this fix. See the GitHub Issue Tracker for additional details.

Workarounds

• Restrict access to MP4Box and GPAC tools to trusted users only
• Process media files only from trusted sources until the patch can be applied
• Implement file validation to detect and reject malformed MP4 files with suspicious box sizes
• Run media processing operations in isolated containers or sandboxed environments

# Configuration example
# Update GPAC to the latest patched version
git clone https://github.com/gpac/gpac/
cd gpac
# Verify the fix is included
git log --oneline | grep cf6ac48c
# Build and install updated version
./configure
make
sudo make install