CVE-2026-71613: GPAC Buffer Overflow Vulnerability

CVE-2026-71613 Overview

CVE-2026-71613 is a buffer overflow vulnerability in GPAC, an open-source multimedia framework. The flaw resides in the j2kdec_process() function within the JPEG 2000 decoder filter. An attacker can trigger the overflow by supplying a crafted media file that causes an integer overflow during output buffer size calculation. Successful exploitation allows arbitrary code execution in the context of the process handling the malformed input. The vulnerability affects GPAC at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and was fixed in commit 9a253a07fd3f6b48022bba74302bf39388dda859.

Critical Impact
Attackers can execute arbitrary code by delivering a malicious JPEG 2000 stream to a vulnerable GPAC build, potentially compromising media processing pipelines and end-user systems.

Affected Products

GPAC multimedia framework at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3
GPAC dec_j2k JPEG 2000 decoder filter
Applications and pipelines embedding vulnerable GPAC builds

Discovery Timeline

2026-09-09 - CVE-2026-71613 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71613

Vulnerability Analysis

The vulnerability lives in src/filters/dec_j2k.c, specifically in the j2kdec_process() function that handles JPEG 2000 decoded frames. The routine computes an output buffer size using ctx->width * ctx->height * ctx->nb_comp. When attacker-controlled image dimensions and component counts are large enough, this multiplication overflows the 32-bit integer type used to store the result. The resulting out_size is smaller than the actual pixel payload, and downstream writes into the allocated buffer exceed its bounds. This produces a heap buffer overflow that a crafted input can steer toward arbitrary code execution.

Root Cause

The root cause is missing overflow validation before allocating the output buffer. The original code assigned ctx->out_size directly from a 32-bit multiplication of three attacker-influenced fields. Integer wraparound during that computation causes the allocator to reserve less memory than the decoder later writes, producing an out-of-bounds write.

Attack Vector

Exploitation requires the target to process a malicious JPEG 2000 stream through the GPAC dec_j2k filter. Delivery vectors include crafted media files opened locally, container files referencing J2K payloads, and network-facing services that transcode media through GPAC. No authentication is required beyond the ability to submit input to the decoder.

// Source: https://github.com/gpac/gpac/commit/9a253a07fd3f6b48022bba74302bf39388dda859
// Patch in src/filters/dec_j2k.c - fixes out_size calculation in j2kdec_process()
 	h = cinfo.image_h;
 #endif
 	ctx->bpp = ctx->nb_comp * 8;
-	ctx->out_size = ctx->width * ctx->height * ctx->nb_comp /* * ctx->bpp / 8 */;
+	if ((u64)ctx->width * ctx->height * ctx->nb_comp > (u64)GF_UINT_MAX) {
+		return GF_BAD_PARAM;
+	}
+	ctx->out_size = ctx->width * ctx->height * ctx->nb_comp;
 
 	switch (ctx->nb_comp) {
 	case 1:

The patch casts operands to u64 before multiplication, compares against GF_UINT_MAX, and returns GF_BAD_PARAM when the product would overflow the unsigned 32-bit range.

Detection Methods for CVE-2026-71613

Indicators of Compromise

Crashes, aborts, or heap corruption reports originating from GPAC processes such as MP4Box or gpac when handling JPEG 2000 content.
Unexpected child processes spawned by GPAC or applications embedding libgpac.
JPEG 2000 payloads with anomalously large image_w, image_h, or component count fields that produce a 32-bit multiplication overflow.

Detection Strategies

Inventory build artifacts and container images to identify GPAC binaries built from commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 or nearby revisions predating the fix.
Instrument decoder pipelines with AddressSanitizer or equivalent heap guards in staging to surface out-of-bounds writes triggered by fuzzed J2K samples.
Alert on GPAC-related process crashes correlated with media ingestion from untrusted sources.

Monitoring Recommendations

Log and review file ingestion events into media processing services, capturing source, size, and MIME type for J2K and MJ2 content.
Monitor endpoints running media tooling for anomalous process lineage, memory faults, and privilege changes after opening media files.
Feed process telemetry, crash dumps, and file provenance into a centralized data lake for retrospective hunting against known-bad hashes and fuzzer-derived signatures.

How to Mitigate CVE-2026-71613

Immediate Actions Required

Rebuild and redeploy GPAC from a source tree that includes commit 9a253a07fd3f6b48022bba74302bf39388dda859 or later.
Restrict GPAC-based media processing to trusted inputs until patched binaries are rolled out across all affected hosts and containers.
Audit third-party applications that statically link or bundle libgpac and coordinate updates with those vendors.

Patch Information

The fix is committed upstream in the GPAC repository. Review the GitHub commit change and the associated GitHub Issue #3613 discussion for full technical context. The patch adds a 64-bit overflow check before computing ctx->out_size and returns GF_BAD_PARAM when the product would exceed GF_UINT_MAX.

Workarounds

Disable the dec_j2k filter in GPAC pipeline configurations where JPEG 2000 support is not required.
Sandbox GPAC execution using seccomp, AppArmor, or containers with minimal privileges to reduce blast radius from decoder faults.
Pre-validate media inputs by rejecting J2K streams whose declared dimensions and component counts would overflow a 32-bit product before handing them to GPAC.

bash

# Example: rebuild GPAC from a fixed revision and verify the patched commit
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 9a253a07fd3f6b48022bba74302bf39388dda859
./configure --static-bin
make -j"$(nproc)"
sudo make install
gpac -version