CVE-2026-71614: GPAC Media Framework RCE Vulnerability

CVE-2026-71614 Overview

CVE-2026-71614 is a memory corruption vulnerability in GPAC, the open-source multimedia framework used for packaging, streaming, and playback of MPEG-4, 3GPP, and DVB content. The flaw resides in src/media_tools/dvb_mpe.c, specifically within the descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() functions. An attacker can craft a malicious DVB Multi-Protocol Encapsulation (MPE) stream to trigger the flaw and execute arbitrary code in the context of the GPAC process. The vulnerability affects GPAC commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and was fixed in commit 0e4093392e1f847c90d20e031e893cd942fef938.

Critical Impact
Processing an untrusted DVB MPE stream with a vulnerable GPAC build can result in arbitrary code execution on the host running the parser.

Affected Products

GPAC multimedia framework at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3
GPAC builds shipping src/media_tools/dvb_mpe.c prior to the fix commit
Downstream tools and pipelines that link GPAC's DVB MPE parsing routines

Discovery Timeline

2026-09-09 - CVE-2026-71614 published to NVD
2026-09-09 - Last updated in NVD database
Fix committed upstream in GPAC commit 0e4093392e1f847c90d20e031e893cd942fef938 referencing GitHub issue #3614

Technical Details for CVE-2026-71614

Vulnerability Analysis

GPAC parses DVB Multi-Protocol Encapsulation (MPE) sections through gf_m2ts_ipdatagram_reader() and helper routines in dvb_mpe.c. The parser walks a variable-length descriptor loop using length fields taken directly from attacker-controlled section data. Insufficient bounds checking on those length fields lets a crafted section drive the read pointer past the end of the allocated buffer. This produces out-of-bounds reads and heap memory corruption that a skilled attacker can leverage for arbitrary code execution inside the GPAC process.

Root Cause

The root cause is missing validation of an attacker-supplied loop length before it is consumed by the descriptor loop iterator. The pre-patch code decremented length by 12 and then iterated with while (length > 4) without confirming that the inner descriptor loop_length fit inside the remaining buffer. A truncated section or oversized encoded length caused the parser to overrun the buffer and, on the free path, mishandle partially initialized GF_M2TS_IP_Stream allocations.

Attack Vector

Exploitation requires the target to parse an attacker-supplied MPEG-2 transport stream containing a malformed DVB MPE section. This can occur through file-based parsing (for example, MP4Box or gpac command-line usage), streaming ingest, or any downstream tool that links libgpac and processes untrusted DVB data.

// Patch excerpt from src/media_tools/dvb_mpe.c
// Source: https://github.com/gpac/gpac/commit/0e4093392e1f847c90d20e031e893cd942fef938

	length = data_size ;
	data += 12 ;
	length -= 12;

	if (!ip_platform || !ip_platform->ip_streams) return;
	i = dsmcc_pto_platform_descriptor_loop(ip_platform,data);
	data   += i;
	length -= i;

	while (length > 4) {

		u32 loop_length = ((data[0]) & 0xF ) | data[1];
		if (loop_length > length)
			break;

		GF_M2TS_IP_Stream *ip_str;
		GF_SAFEALLOC(ip_str,GF_M2TS_IP_Stream );

		i = dsmcc_pto_descriptor_loop(ip_str,data);
		data   += i;
		length -= i;

		loop_length = ((data[0]) & 0xF ) | data[1];
		if (loop_length > length) {
			gf_free(ip_str);
			break;
		}

The patch adds two explicit loop_length > length guards that abort parsing before any out-of-bounds read occurs and releases the freshly allocated GF_M2TS_IP_Stream on the second guard to avoid a leak on the error path.

Detection Methods for CVE-2026-71614

Indicators of Compromise

Crash reports or core dumps from gpac, MP4Box, or applications embedding libgpac when parsing MPEG-2 transport streams containing DVB MPE sections
AddressSanitizer or Valgrind reports flagging heap-buffer-overflow reads inside gf_m2ts_ipdatagram_reader() or descriptorTime_slice_fec_identifier()
Unexpected child processes or shell activity spawned from a media processing pipeline that ingests untrusted transport streams

Detection Strategies

Inventory hosts running GPAC and compare installed commit hashes against the fix commit 0e4093392e1f847c90d20e031e893cd942fef938
Rebuild GPAC with ASan/UBSan in test environments and replay suspect DVB streams to surface the flaw before production impact
Add file-type inspection to identify MPEG-2 TS files entering media processing workflows from external sources

Monitoring Recommendations

Log invocations of GPAC binaries with command-line arguments and input file paths for forensic review
Alert on abnormal termination signals (SIGSEGV, SIGABRT) originating from processes linked against libgpac
Monitor outbound network activity and process lineage from media transcoding hosts to detect post-exploitation behavior

How to Mitigate CVE-2026-71614

Immediate Actions Required

Upgrade GPAC to a build that includes commit 0e4093392e1f847c90d20e031e893cd942fef938 or later
Rebuild and redistribute any internal packages, containers, or appliances that statically link libgpac
Restrict DVB MPE parsing to trusted inputs until patched binaries are deployed across the environment

Patch Information

The upstream fix is available in the GPAC repository. See the GitHub commit for the dvb_mpe fix and the tracking GitHub issue #3614 for background. Consumers building from source should pull the latest master branch or a release tag that includes the patch commit.

Workarounds

Disable DVB MPE ingestion paths in GPAC-based pipelines when patched binaries are not yet available
Sandbox GPAC parsing processes using seccomp, AppArmor, or containers with no network egress and minimal filesystem access
Pre-validate transport streams with a hardened parser and reject sections whose descriptor loop lengths exceed the remaining payload size

bash

# Rebuild GPAC from the patched source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 0e4093392e1f847c90d20e031e893cd942fef938
./configure --static-mp4box --use-zlib=no
make -j"$(nproc)"
sudo make install

# Verify the installed version references the fix commit
MP4Box -version 2>&1 | grep -i gpac