CVE-2026-91088: GPAC URL Handler Buffer Overflow Vulnerability

CVE-2026-91088 Overview

CVE-2026-91088 is a heap-based buffer overflow in GPAC, an open-source multimedia framework used for packaging, streaming, and playing multimedia content. The flaw resides in the gf_url_concatenate_ex function within utils/url.c, part of the URL Handler component. Attackers can trigger the overflow by supplying crafted URL input to a locally executed GPAC process. The issue affects GPAC builds up to commit f1219cde and is resolved in release abi-16.23 via commit afca1f1181668d85941d51ed1adf647807d5d975. The vulnerability is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Local exploitation of this heap buffer overflow can corrupt process memory in GPAC, potentially leading to crashes or memory-safety violations during multimedia URL processing.

Affected Products

GPAC multimedia framework builds up to commit f1219cde
GPAC URL Handler component (utils/url.c, function gf_url_concatenate_ex)
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-15 - CVE-2026-91088 published to NVD
2026-09-15 - Last updated in NVD database
Patch commit - afca1f1181668d85941d51ed1adf647807d5d975 merged into GPAC upstream, released as abi-16.23

Technical Details for CVE-2026-91088

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow triggered inside gf_url_concatenate_ex, a URL concatenation helper in GPAC's utils/url.c. When manipulated input is passed to this function, the resulting write operation exceeds the bounds of the allocated heap buffer. The attack surface is local: a user must invoke GPAC against a crafted URL or media asset. Exploitation requires low privileges and user interaction, which limits remote attack scenarios but still exposes workflows that process untrusted media manifests, playlists, or containers referencing external URLs. Because GPAC is embedded in transcoding pipelines, forensic tooling, and desktop players, corrupted heap state can propagate into downstream parsing routines. The fuzz-driven fixes released alongside this CVE address additional memory-safety issues in reframe_mpgvid.c and lsr_dec.c, indicating a broader hardening effort against malformed input.

Root Cause

The root cause is insufficient bounds validation on inputs passed to gf_url_concatenate_ex. The function did not correctly enforce the size of the destination buffer relative to the concatenated URL components, allowing out-of-bounds writes on the heap. Related patches replace gf_assert calls with explicit runtime length and content checks, and switch to GF_SAFEALLOC-style allocation to prevent similar unchecked buffer arithmetic.

Attack Vector

An attacker must have local access and be able to induce GPAC to process an attacker-controlled URL string. This typically involves supplying a malicious media file, manifest, or command-line argument that reaches the URL Handler. Successful exploitation corrupts heap metadata or adjacent allocations, which can lead to a denial of service and, depending on heap layout, memory disclosure or code execution primitives.

// Patch excerpt: src/filters/reframe_mpgvid.c
// Replaces unchecked gf_assert calls with runtime validation
		if (ftype) {
-			gf_assert(pck_data[0] == 0);
-			gf_assert(pck_data[1] == 0);
-			gf_assert(pck_data[2] == 1);
+			if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+				gf_filter_pid_drop_packet(ctx->ipid);
+				gf_filter_pck_discard(dst_pck);
+				return GF_BAD_PARAM;
+			}

			gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
			gf_filter_pck_set_cts(dst_pck, ctx->cts);

Source: GitHub Commit afca1f1

// Patch excerpt: src/laser/lsr_dec.c
// Replaces raw Fixed allocation with a properly typed SVG_ViewBox structure
	case SVG_ViewBox_datatype:
-		f_val = (Fixed*)gf_malloc(sizeof(Fixed));
-		if (!f_val) {
-			lsr->last_error = GF_OUT_OF_MEM;
-		} else {
-			*f_val = lsr_read_fixed_16_8(lsr, "floatValue");
-		}
-		return f_val;
+		SVG_ViewBox *viewbox;
+		GF_SAFEALLOC(viewbox, SVG_ViewBox)
+		return viewbox;

Source: GitHub Commit afca1f1

Detection Methods for CVE-2026-91088

Indicators of Compromise

Unexpected crashes or abort signals from GPAC binaries such as MP4Box, gpac, or MP4Client while parsing URLs or manifests
Heap corruption diagnostics from AddressSanitizer or Glibc malloc reporting on GPAC processes
Media files or playlists containing abnormally long, deeply nested, or malformed URL references processed by GPAC

Detection Strategies

Inventory endpoints and build systems that ship GPAC and confirm the installed version is at or above abi-16.23
Monitor process telemetry for GPAC executables launched from unexpected paths, temporary directories, or user download folders
Enable core-dump collection on multimedia workstations and correlate crashes in gf_url_concatenate_ex with recently opened files

Monitoring Recommendations

Alert on GPAC child processes spawned by browsers, email clients, or chat applications that render untrusted media
Track command-line arguments passed to GPAC tooling to identify overly long URL parameters or suspicious remote references
Log file-open events for .mp4, .mpd, .m3u8, and other GPAC-handled formats sourced from untrusted origins

How to Mitigate CVE-2026-91088

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes commit afca1f1181668d85941d51ed1adf647807d5d975
Audit software that bundles GPAC libraries and coordinate patched rebuilds with those vendors
Restrict local users from processing untrusted media files with GPAC utilities until systems are patched

Patch Information

The fix is delivered in GPAC release abi-16.23 and lands as commit afca1f1181668d85941d51ed1adf647807d5d975. The patch replaces unchecked assertions with runtime validation, tightens buffer size checks in the URL Handler, and adopts safer allocation macros in adjacent decoders. Details are tracked in GitHub Issue #3808 and mirrored at VulDB CVE-2026-91088.

Workarounds

Avoid opening media files, playlists, or manifests from untrusted sources with vulnerable GPAC builds
Run GPAC tooling inside sandboxes or containers with restricted filesystem and network access
Disable or remove GPAC command-line utilities on hosts where they are not required

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install

# Confirm the patched commit is present
git log --oneline | grep afca1f1