CVE-2026-4016: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4016 is a heap buffer overflow vulnerability (out-of-bounds read and write) in GPAC version 26.03-DEV, affecting the svgin_process() function in src/filters/load_svg.c (lines 210–212) within the SVG/DIMS parser component. The vulnerability was reported on February 22, 2026, publicly disclosed on March 12, 2026, and a patch was committed shortly thereafter. It affects GPAC 26.03-DEV (master HEAD) and the 26.02 stable release on Windows and Linux platforms. The CVSS v3.1 base score is 5.3 (Medium), and the CVSS v4.0 base score is 4.8 (Medium) (GPAC Issue #3468, VulDB).

The root cause is an improper restriction of memory buffer operations (CWE-119 / CWE-787). In svgin_process(), the outer packet size (pck_size) is used to allocate buf2 via gf_malloc(size+1). However, inside the DIMS parsing loop, a 16-bit inner unit size is read from the bitstream via gf_bs_read_u16(bs) and stored back into the same size variable, overwriting the original allocation size. With no bounds check between the inner size read and subsequent buffer accesses, the expression buf2[pos + nb_bytes + size] can reference memory far beyond the allocated buffer — for example, an inner size of 0x2000 (8192) against a buffer of only ~10 bytes. This results in an OOB read at line 210 and an OOB write (null-byte write) at line 212. Exploitation requires local access and the ability to supply a crafted MP4 file containing a malicious DIMS sample. A public PoC Python script (poc_dims_oob.py) and a trigger file (poc_dims_oob.mp4) have been disclosed (GPAC Issue #3468, PoC Script, Patch Commit).

Successful exploitation can result in low-impact confidentiality, integrity, and availability consequences, as reflected in the CVSS scoring. The OOB write (null-byte) and OOB read can cause application crashes (denial of service), potential memory disclosure, or heap corruption that could theoretically be leveraged for further exploitation. Because the attack vector is local and the scope is unchanged, the risk of lateral movement or broad data exposure is limited; however, in environments where GPAC processes untrusted media files (e.g., automated transcoding pipelines), the impact could be more significant (GPAC Issue #3468, VulDB).

A public proof-of-concept exploit (both a Python script to generate the malicious MP4 and the trigger file itself) has been disclosed via the GPAC GitHub issue tracker. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSSv4 exploit maturity is rated as "Proof of Concept" (GPAC Issue #3468, PoC Script).

1. Craft the malicious MP4: Use the public PoC script (poc_dims_oob.py) to generate a crafted MP4 file (poc_dims_oob.mp4). The script constructs a minimal ISO BMFF MP4 with a DIMS (Dynamic Interactive Multimedia Scenes) track whose sample declares an inner unit size of 0x2000 (8192 bytes) while the actual packet data is only ~10 bytes.
2. Deliver the file: Place the crafted MP4 in a location accessible to the target GPAC process. This requires local access to the system or the ability to supply input to an automated GPAC-based media processing pipeline.
3. Trigger processing: Execute GPAC against the malicious file: gpac -i poc_dims_oob.mp4 svgplay compositor vout or gpac -i poc_dims_oob.mp4 -o /dev/null. GPAC opens the file and passes the DIMS sample to svgin_process().
4. Trigger OOB access: Inside svgin_process(), the inner DIMS unit size (0x2000) is read from the bitstream and overwrites the size variable. The subsequent access buf2[pos + nb_bytes + size] (e.g., buf2[2 + 8192]) reads and writes beyond the ~11-byte heap allocation, causing a crash or heap corruption.
5. Observe crash: GPAC crashes with a heap buffer overflow, observable via AddressSanitizer output or a segmentation fault, confirming successful triggering of the vulnerability (GPAC Issue #3468, PoC Script).

• Process: GPAC process (gpac, MP4Box) crashing unexpectedly, particularly when processing MP4 files containing DIMS/SVG tracks; crash dumps referencing svgin_process or load_svg.c.
• File System: Presence of unexpected MP4 files with DIMS sample entries (handler type sdsm, sample entry type dims) in input directories of GPAC-based pipelines; files with very small actual data but large declared inner DIMS unit sizes.
• Logs: AddressSanitizer (ASan) reports indicating heap-buffer-overflow in svgin_process() at src/filters/load_svg.c:210-212; application crash logs referencing gf_malloc and out-of-bounds memory access.
• Network: Unexpected delivery of MP4 files to GPAC processing endpoints from untrusted sources (relevant in automated pipeline scenarios).

The GPAC project has issued a patch in commit 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2, which separates the packet size (pck_size) from the inner DIMS unit size (size) and adds an explicit bounds check (if (pos + nb_bytes + size >= pck_size) { e = GF_NON_COMPLIANT_BITSTREAM; break; }) before any buffer access. Users should update GPAC to a version that includes this commit (post-26.03-DEV master). As a workaround, avoid processing untrusted MP4 files containing DIMS/SVG tracks with unpatched GPAC installations, and consider running GPAC in a sandboxed environment when handling untrusted media (Patch Commit, GPAC Issue #3468).

The vulnerability was reported by researcher "BreakingBad6" via the GPAC GitHub issue tracker on February 22, 2026, and was acknowledged and patched by GPAC maintainer "aureliendavid" with commit 7618d72. Red Hat has tracked the CVE in their security advisory database. Coverage has appeared on VulDB, ENISA's EUVD, and several CVE aggregator sites. No significant broader media coverage or notable social media discussion beyond standard CVE tracking has been identified (GPAC Issue #3468, Red Hat Advisory, VulDB).