CVE-2026-27821: 
NixOS vulnerability analysis and mitigation

CVE-2026-27821 is a stack-based buffer overflow vulnerability in GPAC, an open-source multimedia framework, affecting all versions up to and including 26.02.0. The flaw resides in the NHML demuxer component (src/filters/dmx_nhml.c) and is triggered during NHML file parsing. It was disclosed on February 24–26, 2026, with a patch committed shortly after. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow). In src/filters/dmx_nhml.c, a fixed-size 1000-byte stack buffer szXmlHeaderEnd[1000] is declared at line 620. At lines 803–804, the value of the xmlHeaderEnd XML attribute is copied into this buffer using strcpy() with no length validation — if the attribute value exceeds 1000 bytes, it overwrites memory beyond the stack buffer boundary. The fix (commit 9bd7137) replaces strcpy() with strncpy() bounded by GF_ARRAY_LENGTH(szXmlHeaderEnd)-1 and explicitly null-terminates the buffer (GitHub Advisory, Patch Commit).

Successful exploitation can result in denial of service (process abort via stack canary detection) or, on systems without stack canary protection, potential arbitrary code execution through instruction pointer (RIP) control. The vulnerability requires local access and user interaction (opening a malicious NHML file), limiting its scope, but a compromised GPAC process could expose confidentiality, integrity, and availability of the affected system at a high level (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available as part of the GitHub Security Advisory, including a Dockerized test environment demonstrating the overflow on Ubuntu 22.04 with an ARM64 Apple M4 host. The CVSS v4.0 exploit maturity is rated "Proof of Concept." The EPSS score is approximately 0.048%, indicating low but non-zero probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Craft a malicious NHML file: Create an NHML XML file containing an xmlHeaderEnd attribute whose value exceeds 1000 bytes (e.g., a string of 1001+ characters).
2. Deliver the file to the target: Social-engineer or otherwise cause a user running a vulnerable GPAC version (≤ 26.02.0) to open or process the malicious NHML file with a GPAC tool (e.g., gpac CLI or an application using the GPAC library).
3. Trigger the overflow: When GPAC parses the NHML file, the NHML demuxer (dmx_nhml.c) reads the xmlHeaderEnd attribute and copies it into the 1000-byte stack buffer using strcpy(), overwriting adjacent stack memory.
4. Achieve DoS or code execution: If stack canaries are enabled, the process aborts (DoS). If not, the overwritten return address or saved registers may allow RIP control, enabling arbitrary code execution in the context of the GPAC process (GitHub Advisory).

• Process: Unexpected crash or abort of a GPAC process (gpac, MP4Box, or applications embedding libgpac) immediately after opening an NHML file; stack smashing detected messages in stderr (e.g., *** stack smashing detected ***).
• File System: Presence of unusually large or malformed .nhml files with xmlHeaderEnd attribute values exceeding 1000 bytes.
• Logs: Application crash logs or core dumps associated with GPAC processes; AddressSanitizer (ASAN) reports referencing dmx_nhml.c or szXmlHeaderEnd.

The vulnerability is patched in commit 9bd7137fded2db40de61a2cf3045812c8741ec52, which replaces the unsafe strcpy() call with a length-bounded strncpy(). Users should update GPAC to any version incorporating this commit (post-26.02.0). No configuration-based workaround is available; upgrading or rebuilding from the patched source is the recommended remediation. Compiling with stack canary protection (-fstack-protector) mitigates the code execution risk but does not prevent the DoS (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher wooseokdotkim and acknowledged by GPAC maintainer aureliendavid, who published the advisory and committed the fix. Coverage has appeared on vulnerability aggregation platforms including Tenable Nessus (plugin 300487), VulDB, and ENISA's EUVD (EUVD-2026-8784). A brief technical write-up was published at infinitsec.net shortly after disclosure (GitHub Advisory, Tenable).