Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-33144: GPAC MP4Box may overwrite memory with crafted file

CVE-2026-33144 · published 7 months ago

Summary

The MP4Box tool in the GPAC multimedia framework can write data beyond its intended memory area when it processes a specially crafted NHML file containing malicious <BS> elements. This could allow an attacker to cause the program to behave unexpectedly or potentially take control of the system. Update GPAC to the latest version that includes the fix or avoid opening untrusted NHML files.

What to do

Update gpac gpac to version 2026-03-17 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	gpac	All versions
–	gpac	gpac	< 2026-03-17 `cpe:2.3:a:gpac:gpac::::::::`

Original advisory text

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33144... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33144 Vendor Advisory
https://github.com/gpac/gpac/security/advisories/GHSA-3jw5-9pmw-vmfg Vendor Advisory
https://github.com/gpac/gpac/commit/86b0e36ea4c71402fbdaf7e13d73ba8841003e72 Patch
https://security-tracker.debian.org/tracker/CVE-2026-33144 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published20 Mar 2026

Updated26 Oct 2026

First seen20 Mar 2026

Sources

CVE-2026-33144 · NVD

DEBIAN-CVE-2026-33144 · OSV

CVE-2026-33144 · OSV

GHSA-3jw5-9pmw-vmfg · GHSA

Track software like this

Free during beta