CVE-2026-71612: GPAC Buffer Overflow Vulnerability

CVE-2026-71612 Overview

CVE-2026-71612 is a buffer overflow vulnerability in GPAC, an open-source multimedia framework used for packaging, streaming, and playing MPEG-4 content. The flaw resides in the nhntdmx_process() function within the NHNT demuxer (src/filters/dmx_nhnt.c) at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. Attackers who supply a crafted media input can trigger the overflow and execute arbitrary code in the context of the GPAC process. The issue was fixed in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 by replacing unbounded string operations with length-aware equivalents.

Critical Impact
A crafted file path or media input processed by GPAC's NHNT demuxer can overflow a stack buffer and allow arbitrary code execution in the process context.

Affected Products

GPAC multimedia framework at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3
Builds of GPAC that include the vulnerable dmx_nhnt.c NHNT demuxer prior to the fix
Applications and pipelines embedding vulnerable GPAC libraries for media processing

Discovery Timeline

2026-09-09 - CVE-2026-71612 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71612

Vulnerability Analysis

GPAC's NHNT demuxer constructs a companion .info file path from a caller-supplied media URL. The pre-patch code uses strcpy() and strcat() against a fixed-size stack buffer szMedia without validating the length of the source string. When the input path exceeds the destination buffer, adjacent stack memory is overwritten. An attacker who controls the source URL, either through a crafted file, playlist, or pipeline input, can corrupt the saved return address or function pointers on the stack. Because GPAC is frequently used inside content-processing pipelines, media servers, and desktop players, exploitation can lead to arbitrary code execution with the privileges of the host process.

Root Cause

The root cause is unsafe use of unbounded C string primitives on attacker-controlled data. strcpy() and strcat() do not honor the size of szMedia, so any input longer than the destination buffer produces an out-of-bounds write on the stack, a classic [CWE-121] stack-based buffer overflow.

Attack Vector

Exploitation requires GPAC to process a media input whose path or URL, once combined with the .info suffix, exceeds sizeof(szMedia). In server-side transcoding, streaming, or automated ingestion workflows, an attacker can plant or reference such an input remotely. In client contexts, a user opening a crafted file is sufficient to trigger the overflow.

// Patch: src/filters/dmx_nhnt.c - safer string operations
// Source: https://github.com/gpac/gpac/commit/fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6
            gf_filter_pid_set_property(ctx->opid, GF_PROP_PID_TIMESCALE, &PROP_UINT(ctx->timescale));

            if (use_gfio) {
-               strcpy(szMedia, gf_fileio_translate_url(p->value.string) );
+               gf_strlcpy(szMedia, gf_fileio_translate_url(p->value.string), sizeof(szMedia) );
            } else {
-               strcpy(szMedia, p->value.string);
+               gf_strlcpy(szMedia, p->value.string, sizeof(szMedia));
            }
            ext = gf_file_ext_start(szMedia);
            if (ext) ext[0] = 0;
-           strcat(szMedia, ".info");
+           gf_strlcat(szMedia, ".info", sizeof(szMedia));

            finfo = gf_fopen_ex(szMedia, p->value.string, "rb", GF_FALSE);
            dsi = NULL;

The patch replaces strcpy() with gf_strlcpy() and strcat() with gf_strlcat(), both of which accept the destination buffer size and truncate rather than overflow.

Detection Methods for CVE-2026-71612

Indicators of Compromise

Crashes, segmentation faults, or abnormal terminations of GPAC binaries such as MP4Box or gpac when processing NHNT inputs.
Media files or URLs with unusually long path or filename components referenced by GPAC pipelines.
Unexpected child processes or outbound network connections spawned by the GPAC process after loading untrusted media.

Detection Strategies

Inventory build artifacts and container images for GPAC versions preceding commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 and flag any that include the vulnerable dmx_nhnt.c.
Use software composition analysis to identify applications that statically or dynamically link vulnerable GPAC libraries.
Run fuzzing or unit tests against NHNT inputs with oversized path strings to reproduce the overflow in test environments.

Monitoring Recommendations

Monitor endpoint and server telemetry for GPAC process crashes and unexpected process lineage originating from media-processing services.
Alert on media ingestion jobs that submit inputs with abnormally long URLs or filenames.
Correlate GPAC execution events with subsequent shell, script, or network activity to identify possible post-exploitation behavior.

How to Mitigate CVE-2026-71612

Immediate Actions Required

Upgrade GPAC to a build that includes commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6 or later.
Rebuild and redeploy any downstream applications, containers, or packages that embed the GPAC libraries.
Restrict GPAC processing to trusted media sources until patched builds are rolled out.

Patch Information

The upstream fix is available in the GPAC repository. Review the GPAC commit fac50e6a for the code changes and the GPAC issue #3612 discussion for context on the fuzz-discovered defect. The patch replaces unsafe string primitives with gf_strlcpy() and gf_strlcat() in src/filters/dmx_nhnt.c.

Workarounds

Disable or remove the NHNT demuxer from GPAC pipelines that do not require it.
Run GPAC under a low-privilege service account and inside a sandbox or container with seccomp and no-new-privileges enabled.
Enforce input validation at the ingestion layer to reject media paths and URLs that exceed a conservative length threshold.

bash

# Build GPAC from the patched commit
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6
./configure --use-hardening=yes
make -j$(nproc)
sudo make install

# Verify the installed version no longer references the vulnerable commit
MP4Box -version