CVE-2026-93331: GPAC RTP Depacketizer RCE Vulnerability

CVE-2026-93331 Overview

CVE-2026-93331 is an out-of-bounds read vulnerability in GPAC 26.08-DEV, an open-source multimedia framework. The flaw resides in the gf_rtp_parse_ttxt function within src/ietf/rtp_depacketizer.c, part of the RTP Depacketizer component. Manipulation of the size argument allows a remote attacker to trigger memory reads beyond the intended buffer boundary. The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vulnerability can be exploited remotely without authentication or user interaction, though impact is limited to confidentiality, integrity, and availability at low levels. Upgrading to GPAC release abi-16.26 resolves the issue via commit 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68.

Critical Impact
Remote attackers can send crafted RTP timed-text (TTXT) payloads to trigger out-of-bounds memory reads, potentially leaking process memory or crashing the GPAC RTP session handler.

Affected Products

GPAC 26.08-DEV (RTP Depacketizer component)
GPAC builds prior to release abi-16.26
Applications and services embedding vulnerable GPAC RTP depacketizer code

Discovery Timeline

2026-09-18 - CVE-2026-93331 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93331

Vulnerability Analysis

The vulnerability affects GPAC's Real-time Transport Protocol (RTP) depacketization logic for timed text (TTXT) payloads. In the vulnerable gf_rtp_parse_ttxt function, the parser reads a 16-bit ttu_len field from the incoming RTP payload and iterates over embedded text units without validating that the advertised length fits within the actual buffer size. When ttu_len exceeds the remaining payload bytes, subsequent reads dereference memory beyond the allocated buffer. This produces an out-of-bounds read that can leak adjacent process memory or terminate the application when the read crosses an unmapped page.

Root Cause

The root cause is missing bounds validation between the payload-advertised size (ttu_len) and the actual buffer size (size). The parser trusted attacker-controlled length fields from the network without cross-checking pay_start + ttu_len + 1 against size. This is a classic [CWE-119] boundary condition error introduced through insufficient input validation on network-supplied length metadata.

Attack Vector

An unauthenticated remote attacker can deliver a crafted RTP packet to a GPAC-based receiver processing TTXT streams. Because RTP is commonly transported over UDP, the attack requires only network reachability to the target port. No user interaction or prior privileges are required. Repeated exploitation can be used for information disclosure of process memory or as a denial-of-service primitive against media servers, WebRTC gateways, or streaming clients that embed GPAC.

 		type = gf_bs_read_int(bs, 3);
 		ttu_len = gf_bs_read_u16(bs);
 		if (ttu_len<2) break;
+		if (pay_start + ttu_len + 1 > (u64) size) {
+			GF_LOG(GF_LOG_WARNING, GF_LOG_RTP, ("[RTP] Payload advertised size (%lu) incompatible with buffer size (%lu) - ignoring\n", ttu_len, size-pay_start-1));
+			break;
+		}

 		if (type==1) {
 			/*flush any existing packet*/

Source: GPAC Commit 6bb0f64b. The patch adds an explicit check comparing the advertised ttu_len against the real buffer size and emits a warning before breaking out of the parsing loop.

Detection Methods for CVE-2026-93331

Indicators of Compromise

Unexpected GPAC process crashes or segmentation faults associated with RTP session handling
Warning log entries from GPAC's RTP subsystem referencing malformed TTXT payloads or payload-size mismatches
Anomalous RTP traffic containing TTXT payloads with ttu_len values inconsistent with the actual UDP datagram size

Detection Strategies

Inspect RTP streams at network boundaries for TTXT payloads whose declared length exceeds the enclosing UDP payload size
Enable verbose GPAC logging (GF_LOG_RTP at warning level) to surface parser rejections and malformed packet events
Correlate crash telemetry from services embedding GPAC with inbound RTP source addresses to identify probing activity

Monitoring Recommendations

Track GPAC and libgpac versions across the environment and flag hosts running builds prior to abi-16.26
Alert on repeated abnormal termination of media processing workers or streaming daemons that link GPAC
Monitor egress from media servers for unexpected data volumes that may indicate memory disclosure exfiltration

How to Mitigate CVE-2026-93331

Immediate Actions Required

Upgrade GPAC to release abi-16.26 or later, which contains commit 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68
Inventory all applications, containers, and appliances that bundle GPAC or libgpac and prioritize patching internet-facing systems
Restrict inbound RTP traffic to trusted peers using firewall rules or SBC (Session Border Controller) policies

Patch Information

The fix is available in the GPAC abi-16.26 release and applied via commit 6bb0f64b. The patch validates that pay_start + ttu_len + 1 does not exceed the real buffer size before the parser continues reading TTU data. Additional context is available in GPAC Issue #3868 and the VulDB entry for CVE-2026-93331.

Workarounds

Disable RTP TTXT (timed text) stream processing where the feature is not required
Place vulnerable GPAC deployments behind an RTP-aware proxy or SBC that validates payload sizing
Run GPAC-embedding services under restrictive sandboxing (seccomp, AppArmor, or containers) to limit impact of memory disclosure or crashes

bash

# Build and install patched GPAC from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.26
./configure
make -j$(nproc)
sudo make install

# Verify the installed version
MP4Box -version