CVE-2026-1418: 
NixOS vulnerability analysis and mitigation

CVE-2026-1418 is an out-of-bounds write vulnerability in GPAC's SRT subtitle import component, specifically in the gf_text_import_srt_bifs() function within src/scene_manager/text_to_bifs.c. It affects GPAC versions up to and including 2.4.0. The vulnerability was reported on January 11, 2026, and publicly disclosed on January 26, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, GPAC Issue #3425).

The root cause is classified as CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In gf_text_import_srt_bifs(), subtitle text is converted into UTF-8-like output and written into a fixed-size stack buffer char szText[2048] without bounds checking. When processing non-UTF-8 bytes (e.g., high-bit bytes such as 0xFF), the conversion loop may write an extra prefix byte plus the original byte per character, causing output expansion that overflows the 2048-byte buffer. Exploitation requires local access and low privileges — an attacker must supply a crafted SRT file to MP4Box via the BIFS scene pipeline (e.g., MP4Box -mp4 scene.bt). A public proof-of-concept and a PoC zip file were included in the original bug report (GPAC Issue #3425).

Successful exploitation can result in memory corruption on the stack, potentially leading to application crashes (denial of service) or arbitrary code execution in the context of the user running MP4Box. Confidentiality, integrity, and availability are all potentially affected, though the local-only attack vector limits the blast radius to systems where untrusted SRT files are processed. Lateral movement potential is low given the local attack requirement, but the vulnerability could be chained with other weaknesses in multi-user or automated media processing environments (Feedly, GPAC Issue #3425).

A proof-of-concept exploit (including a PoC zip and Python script to generate a malicious SRT file) was publicly disclosed in the GitHub issue at the time of reporting. There is no evidence of in-the-wild exploitation as of the latest available data, and no threat actor attribution has been made. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 296606 has been released to detect this vulnerability (GPAC Issue #3425, Feedly).

1. Prepare the malicious SRT file: Create a crafted SRT subtitle file containing a large number of non-UTF-8 bytes (e.g., 0xFF) on a subtitle line. A Python script can generate this: write a subtitle block with ~1100 \xff bytes as the subtitle text, which causes output expansion beyond the 2048-byte stack buffer when processed.
2. Prepare the BIFS scene file: Create a scene_bifs.bt VRML/BIFS scene file that references the malicious SRT file via a MuxInfo descriptor with textNode and fontNode fields pointing to scene nodes.
3. Invoke MP4Box: Run MP4Box -mp4 scene_bifs.bt -out output.mp4 on a system running GPAC ≤ 2.4.0. This triggers the BIFS scene encoding pipeline, which calls gf_text_import_srt_bifs() to import the SRT subtitles.
4. Trigger the overflow: The conversion loop in gf_text_import_srt_bifs() processes each 0xFF byte, writing two bytes (a prefix and the original byte) into szText[2048] without bounds checking, overflowing the stack buffer at index 2048 and beyond.
5. Achieve impact: Depending on memory layout and platform mitigations, the overflow may crash the application (denial of service) or, in a less protected environment, potentially allow arbitrary code execution (GPAC Issue #3425).

• File System: Presence of crafted .srt files containing large sequences of 0xFF or other non-UTF-8 high-bit bytes in subtitle lines; unexpected .bt BIFS scene files referencing external SRT files via MuxInfo descriptors.
• Process: MP4Box process crashing or exiting abnormally during SRT subtitle import operations; core dump files generated by the MP4Box process.
• Logs: Application logs or stderr output containing messages such as [srt->bifs] Illegal UTF8 data (introduced by the patch), or ASan/UBSan runtime error messages referencing scene_manager/text_to_bifs.c:315 and gf_text_import_srt_bifs.
• Network: In automated media processing pipelines, unexpected job failures or timeouts when processing SRT files from untrusted external sources (GPAC Issue #3425).

The fix is available in commit 10c73b82cf0e367383d091db38566a0e4fe71772, which adds a UTF-8 validity check (gf_utf8_is_legal()) before processing subtitle lines, returning GF_CORRUPTED_DATA on illegal input rather than writing past the buffer. Users should upgrade GPAC to a version beyond 2.4.0 that includes this patch. As a workaround until patching is possible, restrict GPAC usage to trusted users, avoid processing SRT files from untrusted or unknown sources, and consider implementing file validation to screen subtitle files before ingestion (GPAC Patch Commit, Feedly).

The vulnerability was noted by automated CVE tracking accounts on X (formerly Twitter) and Bluesky shortly after disclosure. Red Hat has acknowledged the CVE in their security advisory tracker. No significant vendor statements beyond the patch commit or notable researcher commentary beyond the original bug report have been identified (Red Hat Advisory).