CVE-2026-91086: GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow
A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmxprocess of the file filters/reframempgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC (MPEG Video Reframer; filters/reframe_mpgvid.c; mpgviddmx_process)to a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
GPAC deployments using the MPEG Video Reframer component are affected if they are at or below revision f1219cde. The vulnerable code is filters/reframe_mpgvid.c, in the mpgviddmx_process function.
What does an attacker need to exploit the vulnerability?
The issue is remotely exploitable with low attack complexity and requires no privileges, but user interaction is required. Successful exploitation involves manipulating input processed by the MPEG Video Reframer to trigger a heap-based buffer overflow.
Is there public exploit availability?
Yes. The exploit has been publicly disclosed and may be used, which increases the urgency of remediation.
What should be done if the affected component is in use?
Upgrade the affected component to version abi-16.23. The identified patch is afca1f1181668d85941d51ed1adf647807d5d975.