CVE-2026-91086: GPAC Buffer Overflow Vulnerability

CVE-2026-91086 Overview

CVE-2026-91086 is a heap-based buffer overflow vulnerability in GPAC, an open-source multimedia framework, up to commit f1219cde. The flaw resides in the mpgviddmx_process function of filters/reframe_mpgvid.c, part of the MPEG Video Reframer component. Attackers can trigger the overflow remotely by supplying a crafted MPEG video stream that bypasses expected start-code assumptions. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against unpatched systems. The issue is resolved in GPAC release abi-16.23 via commit afca1f1181668d85941d51ed1adf647807d5d975.

Critical Impact
Remote attackers can trigger a heap-based buffer overflow through malformed MPEG video content, potentially leading to memory corruption or process crash [CWE-119].

Affected Products

GPAC multimedia framework versions up to commit f1219cde
GPAC MPEG Video Reframer component (filters/reframe_mpgvid.c)
Applications and services embedding vulnerable GPAC libraries for MPEG video processing

Discovery Timeline

2026-09-15 - CVE-2026-91086 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91086

Vulnerability Analysis

The vulnerability affects the mpgviddmx_process function inside GPAC's MPEG video reframer filter. The function processes packet data without validating that the buffer contains at least three bytes matching the MPEG start-code prefix (00 00 01). When a crafted stream provides fewer bytes than expected or omits the start code, the function operates on out-of-bounds heap memory. This leads to heap-based buffer overflow behavior classified under [CWE-119]. Because GPAC is embedded in media pipelines, browsers, and conversion utilities, malformed inputs delivered over the network can reach the vulnerable code path.

Root Cause

The original code used gf_assert calls to verify the MPEG start-code bytes in pck_data[0..2]. Assertions are compiled out in release builds, so the size and content checks never executed at runtime. When size was less than 3 or the prefix bytes were unexpected, the function continued processing, reading and writing past the allocated heap region.

Attack Vector

Exploitation requires an attacker to deliver a malformed MPEG video stream to an application that uses GPAC for demuxing or reframing. Delivery vectors include hosted media files, streaming endpoints, and user-uploaded content processed server-side. User interaction is required to open or process the content, per the CVSS 4.0 vector.

// Patch excerpt: src/filters/reframe_mpgvid.c
// Replaces silent assertions with explicit size and prefix validation
if (ftype) {
-    gf_assert(pck_data[0] == 0);
-    gf_assert(pck_data[1] == 0);
-    gf_assert(pck_data[2] == 1);
+    if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+        gf_filter_pid_drop_packet(ctx->ipid);
+        gf_filter_pck_discard(dst_pck);
+        return GF_BAD_PARAM;
+    }

    gf_filter_pck_set_framing(dst_pck, GF_TRUE,
        (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
    gf_filter_pck_set_cts(dst_pck, ctx->cts);

Source: GitHub Commit afca1f1. The patch replaces the debug-only assertions with a runtime check that drops the packet and returns GF_BAD_PARAM when the input is invalid.

Detection Methods for CVE-2026-91086

Indicators of Compromise

Unexpected crashes or segmentation faults in processes linking GPAC libraries (libgpac) or invoking the MP4Box and gpac binaries during MPEG video parsing.
MPEG video files or streams where the first bytes of framed packets deviate from the expected 00 00 01 start-code prefix.
Presence of proof-of-concept archives such as poc_10_add.zip referenced in the GitHub Issue #3806 discussion.

Detection Strategies

Enable AddressSanitizer (ASan) in test and staging environments to surface heap-buffer-overflow reports originating from mpgviddmx_process.
Inventory GPAC installations and compare installed versions against release abi-16.23 to identify vulnerable builds.
Inspect media ingestion pipelines for crash telemetry correlated with MPEG video inputs.

Monitoring Recommendations

Collect and centralize crash dumps from media conversion and streaming workloads for triage.
Monitor process exit codes and out-of-memory events on hosts running GPAC-based services.
Track outbound advisories from the GPAC GitHub Repository for follow-on fuzzing fixes bundled with abi-16.23.

How to Mitigate CVE-2026-91086

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all affected hosts.
Rebuild any downstream applications that statically link GPAC libraries against the patched sources.
Restrict acceptance of untrusted MPEG video content until the upgrade is deployed.

Patch Information

The fix is delivered in commit afca1f1181668d85941d51ed1adf647807d5d975 and included in the abi-16.23 release. See GitHub Commit Details for the full patch, which also addresses adjacent memory-safety issues in src/laser/lsr_dec.c. Additional context is available in the VulDB entry for CVE-2026-91086.

Workarounds

Disable the MPEG video reframer filter in GPAC pipelines that do not require legacy MPEG-1/2 video handling.
Pre-validate media inputs at the application boundary and reject files whose framed packets do not begin with the 00 00 01 start code.
Sandbox GPAC processes with seccomp or containerization to constrain the blast radius of a crash or overflow.

bash

# Verify installed GPAC version and upgrade from source
gpac -version

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install