CVE-2026-33144: GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)
GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gfxmlparsebitsequencebs function in utils/xmlbincustom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33144?
The severity of CVE-2026-33144 is considered high due to the potential for remote code execution via heap buffer overflow.
How do I fix CVE-2026-33144?
To fix CVE-2026-33144, upgrade GPAC MP4Box to version 86b0e36 or later.
What are the consequences of CVE-2026-33144?
The consequences of CVE-2026-33144 include potential exploitation leading to arbitrary code execution on vulnerable systems.
Which versions of GPAC MP4Box are affected by CVE-2026-33144?
Versions of GPAC MP4Box prior to commit 86b0e36 are affected by CVE-2026-33144.
Is CVE-2026-33144 related to XML parsing vulnerabilities?
Yes, CVE-2026-33144 involves a heap buffer overflow vulnerability during XML parsing associated with NHML BS.