CVE-2026-33144: 
NixOS vulnerability analysis and mitigation

CVE-2026-33144 is a heap-based buffer overflow (write) vulnerability in GPAC MP4Box affecting the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c. It was discovered on 2026-02-19, disclosed via GitHub Security Advisory GHSA-3jw5-9pmw-vmfg on 2026-03-17, and published to NVD on 2026-03-20. All GPAC versions prior to commit 86b0e36ea4c71402fbdaf7e13d73ba8841003e72 (approximately version 26.03-DEV, commit b515818 and earlier) are affected. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GPAC Advisory).

The root cause is an out-of-bounds write (CWE-787) in the gf_xml_parse_bit_sequence_bs function (src/utils/xml_bin_custom.c, line 702). When parsing <BS> (BitSequence) elements in a crafted NHML file, the function allocates a buffer of len/2 bytes for hex-decoded data but fails to validate: (1) that the hex string length is even before allocation, and (2) that the bits attribute does not exceed 64 before performing bitstream write operations. This allows an attacker-controlled odd-length hex string or oversized bits value to trigger an out-of-bounds heap write. The fix (commit 86b0e36) adds explicit checks rejecting nb_bits > 64 and odd-length szData hex strings, and propagates error codes from gf_xml_parse_bit_sequence_bs back to the caller in dmx_nhml.c (GPAC Advisory, Patch Commit).

Successful exploitation can cause application crashes (denial of service) or, depending on heap layout and allocator behavior, potentially enable arbitrary code execution with the privileges of the MP4Box process. Confidentiality, integrity, and availability are all rated High under the NVD CVSS assessment. Because the attack vector is local and requires user interaction (opening a crafted file), the blast radius is limited to the affected workstation or media processing pipeline, with no direct path to lateral movement unless MP4Box is invoked in an automated or server-side context (GPAC Advisory).

A proof-of-concept exploit (PoC file fuzz_dims.nhml with reproduction command MP4Box -add fuzz_dims.nhml out.mp4) is publicly documented in the GitHub Security Advisory. The EPSS score is approximately 0.012% (0.000120), indicating low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction to supply the malicious NHML file (GPAC Advisory).

1. Craft a malicious NHML file: Create an NHML file (e.g., fuzz_dims.nhml) containing <BS> (BitSequence) elements with either an odd-length hex data attribute or a bits attribute value exceeding 64, which bypasses the (previously absent) input validation in gf_xml_parse_bit_sequence_bs.
2. Deliver the file to the target: Social-engineer the victim into processing the crafted NHML file with MP4Box, or place it in a directory monitored by an automated media processing pipeline that invokes MP4Box.
3. Trigger the overflow: Execute MP4Box -add fuzz_dims.nhml out.mp4. The parser allocates an undersized heap buffer and writes beyond its bounds during bitstream construction.
4. Achieve impact: At minimum, the process crashes (DoS). With a carefully shaped heap layout, the out-of-bounds write may overwrite adjacent heap metadata or function pointers, potentially enabling arbitrary code execution with the privileges of the MP4Box process (GPAC Advisory).

• Process: Unexpected crash or abnormal termination of the MP4Box process; AddressSanitizer output referencing heap-buffer-overflow WRITE at utils/xml_bin_custom.c:702 or utils/bitstream.c:966.
• Logs: Application logs or crash dumps showing stack traces through gf_xml_parse_bit_sequence_bs → gf_xml_parse_bit_sequence → nhmldmx_config_output; UBSan messages such as shift exponent 65 is too large for 64-bit type 'long unsigned int'.
• File System: Presence of unexpected or externally supplied .nhml files (especially named fuzz_dims.nhml or similar fuzzer-generated names) in directories processed by MP4Box; core dump files generated by MP4Box.
• Network: In automated pipeline environments, unexpected outbound connections from the MP4Box process following ingestion of an untrusted NHML file may indicate post-exploitation activity (GPAC Advisory).

Update GPAC to a version incorporating commit 86b0e36ea4c71402fbdaf7e13d73ba8841003e72 or later (released 2026-03-17). The patch adds validation that nb_bits does not exceed 64 and that hex szData strings have even length before buffer allocation. As a workaround where patching is not immediately possible, restrict MP4Box from processing untrusted or externally supplied NHML files, and avoid running MP4Box with elevated privileges. Organizations using automated media pipelines should implement input validation or sandboxing for NHML file ingestion (GPAC Advisory, Patch Commit).

The vulnerability was credited to researchers @ShangzhiXu and @xuemian168, and the advisory was published by GPAC maintainer aureliendavid. The issue was detected by Nessus (plugin 303265) and indexed by ENISA's EUVD (EUVD-2026-13782) and Red Hat's CVE tracker. No significant broader media coverage or notable social media discussion beyond standard CVE aggregator postings has been observed (GPAC Advisory).