CVE-2026-92399: GPAC Buffer Overflow Vulnerability

CVE-2026-92399 Overview

CVE-2026-92399 is a heap-based buffer overflow vulnerability in GPAC 26.07.0, an open-source multimedia framework. The flaw resides in the rmt_client_handle_ws_frame function within src/utils/rmt_ws.c, part of the WebSocket Handler component. Attackers can trigger the overflow remotely by manipulating the payload_size argument in a crafted WebSocket frame. A public proof-of-concept exploit has been disclosed, increasing the risk of opportunistic exploitation. The vulnerability is tracked under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers can send crafted WebSocket frames with an oversized payload_size value to overflow heap memory in GPAC 26.07.0, potentially corrupting adjacent allocations and impacting confidentiality, integrity, and availability.

Affected Products

GPAC 26.07.0
GPAC WebSocket Handler component (src/utils/rmt_ws.c)
Applications embedding the vulnerable GPAC rmt_ws remote monitoring interface

Discovery Timeline

2026-09-16 - CVE-2026-92399 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92399

Vulnerability Analysis

The vulnerability exists in the WebSocket frame handling logic used by the GPAC remote monitoring (rmt) interface. The rmt_client_handle_ws_frame function processes incoming WebSocket frames without adequately validating the payload_size field supplied by the client. When an attacker specifies an oversized payload length, the resulting heap allocation and copy operation write beyond the intended buffer boundary.

Successful exploitation can corrupt adjacent heap metadata and application data structures. Because the WebSocket handler is reachable over the network, an unauthenticated attacker can deliver the malicious frame remotely without user interaction. A public proof-of-concept (poc_rmt_ws_malicious_frame.py) has been published, which lowers the barrier to exploitation attempts against exposed GPAC instances.

Root Cause

The root cause is missing bounds enforcement on attacker-controlled length fields inside the WebSocket parser. Prior to the patch, the code accepted arbitrarily large payload_size values, resulting in unbounded allocations and out-of-bounds heap writes classified under [CWE-119]. The fix introduces an explicit ceiling on payload sizes to reject unreasonable frame lengths before memory operations occur.

Attack Vector

Exploitation requires network access to a GPAC service exposing the rmt WebSocket endpoint. The attacker connects, negotiates the WebSocket handshake, and transmits a frame whose declared payload_size triggers the boundary violation inside rmt_client_handle_ws_frame. No authentication or user interaction is required, and the attack can be launched from any host that can reach the vulnerable listener.

 };
 
-
+#define RMT_MAX_PAYLOAD 256*1024*1024 // limit valid payloads to prevent absurd allocations
 
 GF_DownloadSession *gf_dm_sess_new_server(GF_DownloadManager *dm, GF_Socket *server, void *ssl_ctx, gf_dm_user_io user_io, void *usr_cbk, Bool async, GF_Err *e);
 void  gf_dm_sess_set_header(GF_DownloadSession *sess, const char *name, const char *value);

Source: GPAC Commit 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. The patch introduces the RMT_MAX_PAYLOAD constant, capping accepted WebSocket payloads at 256 MB to prevent oversized allocations that trigger the heap overflow.

Detection Methods for CVE-2026-92399

Indicators of Compromise

Inbound WebSocket frames to a GPAC rmt endpoint carrying abnormally large payload length fields, particularly values exceeding 256 MB.
Unexpected GPAC process crashes, segmentation faults, or heap corruption assertions correlated with WebSocket traffic.
Presence or execution of the public proof-of-concept poc_rmt_ws_malicious_frame.py on internal hosts.

Detection Strategies

Deploy network signatures on WebSocket traffic targeting GPAC instances to flag frames with declared payload sizes above the 256 MB threshold enforced by the patch.
Inspect application logs for repeated client disconnections, malformed frame errors, or crashes originating in rmt_client_handle_ws_frame.
Correlate GPAC process termination events with preceding inbound network sessions to identify potential exploitation attempts.

Monitoring Recommendations

Enable verbose logging on GPAC deployments that expose the rmt WebSocket interface and forward logs to a centralized analytics platform.
Monitor for anomalous outbound connections from hosts running GPAC that may indicate post-exploitation activity.
Alert on any GPAC binary versions matching 26.07.0 in software inventories until patched.

How to Mitigate CVE-2026-92399

Immediate Actions Required

Upgrade GPAC to release abi-16.26 or later, which contains commit 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12.
Identify all GPAC 26.07.0 installations across development, build, and production environments through software inventory queries.
Restrict network exposure of the GPAC rmt WebSocket endpoint to trusted administrative networks only.
Treat any GPAC instance reachable from untrusted networks as high-priority for immediate patching or isolation.

Patch Information

The vendor fix is available in the GPAC Release Tag abi-16.26 and implemented in commit 37bccbb30cf53a0e1a084cea9a1ce422b3ddfe12. The patch adds the RMT_MAX_PAYLOAD limit of 256 MB to reject oversized WebSocket payloads before allocation. Additional context is available in GPAC Issue Tracker #3860 and the VulDB CVE Database entry.

Workarounds

Disable the GPAC rmt remote monitoring feature at build or runtime configuration if it is not required.
Place the GPAC WebSocket listener behind a reverse proxy or firewall that enforces WebSocket frame size limits below 256 MB.
Apply network segmentation to ensure only authenticated internal operators can reach GPAC monitoring interfaces.

bash

# Verify installed GPAC version and upgrade to the fixed release
gpac -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.26
./configure && make && sudo make install