CVE-2026-92475: GPAC Buffer Overflow Vulnerability

CVE-2026-92475 Overview

CVE-2026-92475 is an out-of-bounds read vulnerability in GPAC 26.08-DEV, an open-source multimedia framework. The flaw resides in the wait_for_header_and_parse function within src/utils/downloader.c and is triggered through manipulation of the HTTP Content-Range argument. Exploitation requires local access to the affected system. A public exploit has been made available, though the vulnerability carries a low severity rating. The issue is fixed in release abi-16.26 via commit c74a3065038ede35c1c7b75fa493a69ef6bcdb84. The vulnerability is classified under [CWE-119] for improper restriction of operations within the bounds of a memory buffer.

Critical Impact

Local attackers can trigger an out-of-bounds read in GPAC's downloader component, potentially leading to information disclosure or process instability.

Affected Products

• GPAC 26.08-DEV
• GPAC releases prior to abi-16.26
• Applications embedding the vulnerable GPAC downloader component

Discovery Timeline

• 2026-09-16 - CVE-2026-92475 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92475

Vulnerability Analysis

The vulnerability exists in the wait_for_header_and_parse function inside src/utils/downloader.c. GPAC parses the HTTP Content-Range response header without validating the boundaries of the buffer being read. When a crafted or malformed Content-Range value is supplied, the parser reads memory beyond the allocated buffer.

Out-of-bounds reads in header parsing routines can leak adjacent heap or stack contents. In practice, this may expose sensitive process memory or cause the GPAC process to crash. Because the attack vector requires local access and low privileges, the practical impact is limited to systems where untrusted users can influence GPAC's HTTP fetch operations.

Root Cause

The root cause is a missing boundary check on string traversal within the header parsing logic. Related patches in the same commit demonstrate the same class of bug, where strchr was called on buffers without first confirming that the pointer and the current character were non-null. The fix pattern adds explicit null and length checks before dereferencing header data.

Attack Vector

An attacker with local access can craft or influence an HTTP response containing a malformed Content-Range header that GPAC's downloader will process. When wait_for_header_and_parse handles the header, the out-of-bounds read occurs. A public exploit is available, lowering the barrier for reproduction.

// Patch excerpt: src/bifs/script_enc.c
// Adds null and pointer checks before strchr dereference
 {
 	u32 i;
 	if (sc_enc->err) return GF_FALSE;
-	while (strchr(" \t\r\n", sc_enc->cur_buf[0])) {
+	while (sc_enc->cur_buf && sc_enc->cur_buf[0] && strchr(" \t\r\n", sc_enc->cur_buf[0])) {
 		if (sc_enc->cur_buf[0]=='\n') sc_enc->cur_line ++;
 		sc_enc->cur_buf++;
 	}

Source: GitHub Commit c74a306

// Patch excerpt: src/compositor/svg_text.c
// Same defensive pattern applied to font parsing loop
 	while (a_font) {
 		char *sep;
-		while (strchr("\t\r\n ", a_font[0])) a_font++;
+		while (a_font[0] && strchr("\t\r\n ", a_font[0])) a_font++;
 
 		sep = strchr(a_font, ',');
 		if (sep) sep[0] = 0;

Source: GitHub Commit c74a306

Detection Methods for CVE-2026-92475

Indicators of Compromise

• Unexpected crashes or segmentation faults in GPAC processes such as MP4Box or MP4Client
• HTTP responses processed by GPAC containing malformed or oversized Content-Range headers
• Local users invoking GPAC binaries against attacker-controlled HTTP endpoints

Detection Strategies

• Inventory hosts running GPAC and identify installed versions to flag anything prior to abi-16.26
• Monitor process telemetry for GPAC binaries generating abnormal signals (SIGSEGV, SIGBUS)
• Review network traffic captured by GPAC clients for anomalous HTTP Content-Range values

Monitoring Recommendations

• Enable core dumps for GPAC processes in test environments to identify triggered out-of-bounds reads
• Correlate GPAC process crashes with concurrent local user activity for post-exploitation review
• Track file integrity of GPAC binaries and libraries to detect unauthorized downgrades

How to Mitigate CVE-2026-92475

Immediate Actions Required

• Upgrade GPAC to release abi-16.26 or later, which includes commit c74a3065038ede35c1c7b75fa493a69ef6bcdb84
• Restrict local user access to systems that invoke GPAC against untrusted HTTP sources
• Remove GPAC utilities from multi-user hosts where multimedia processing is not required

Patch Information

The upstream fix is available in the GitHub Release abi-16.26 and the corresponding GitHub Commit c74a306. Additional context is tracked in GitHub Issue #3859 and VulDB CVE-2026-92475.

Workarounds

• Avoid invoking GPAC downloader features against untrusted or attacker-controlled URLs
• Run GPAC under a least-privileged account isolated from sensitive data
• Use sandboxing controls such as seccomp or AppArmor to constrain GPAC process capabilities

# Verify installed GPAC version and upgrade from source
MP4Box -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.26
./configure && make && sudo make install