CVE-2026-4185: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-4185 is a stack-based buffer overflow vulnerability in GPAC up to version 2.5-DEV-rev2167-gcc9d617c0-master, specifically in the swf_def_bits_jpeg function within src/scene_manager/swf_parse.c of the MP4Box component. The vulnerability was reported on January 23, 2026, by researcher PeterXukt and published to NVD on March 16, 2026. It carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Feedly, GitHub Issue).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-121). In the swf_def_bits_jpeg function, an unchecked sprintf call writes the concatenation of read->localPath and a filename suffix into a fixed 1024-byte stack buffer szName without validating the length of read->localPath. An attacker can supply an excessively long file path (e.g., via a deeply nested directory structure) when invoking MP4Box -add <path>/test.swf, causing a write of over 1100 bytes and overflowing the stack buffer. The ASAN output confirms a WRITE of size 1100 at offset 1184 in the szName stack frame (GitHub Issue). A public PoC SWF file and reproduction steps are available (PoC File).

Successful exploitation can result in Denial of Service (DoS) by crashing the MP4Box process, and potentially arbitrary code execution by overwriting the stack return address with attacker-controlled data. The vulnerability affects confidentiality, integrity, and availability at a low level each per the CVSS scoring, but the stack corruption primitive could be leveraged for more severe outcomes depending on platform mitigations. The attack requires low privileges and no user interaction beyond supplying a malformed SWF file via a long path (GitHub Issue, Feedly).

A public proof-of-concept exploit (a malformed SWF file and reproduction steps) has been disclosed by the reporter (PoC File, GitHub Issue). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.064%, indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog at this time (Feedly).

1. Reconnaissance: Identify systems running GPAC MP4Box version 2.5-DEV-rev2167-gcc9d617c0-master or earlier that process untrusted SWF files.
2. Prepare malicious path: Create an excessively long directory path (e.g., 1000+ characters) using a script: export LONG_NAME=$(python3 -c "print('A'*250 + '/' + 'B'*250 + '/' + 'C'*250 + '/' + 'D'*250)") and mkdir -p $LONG_NAME.
3. Place PoC SWF: Copy the malformed SWF file (available at the public PoC repository) into the deeply nested directory: cp test.swf $LONG_NAME/.
4. Trigger the overflow: Execute MP4Box -add $PWD/$LONG_NAME/test.swf test.mp4. During SWF parsing, swf_def_bits_jpeg calls sprintf(szName, "%s/swf_jpeg_%d.jpg", read->localPath, ID) where read->localPath is the long path, writing ~1100 bytes into the 1024-byte szName stack buffer.
5. Achieve impact: The stack buffer overflow corrupts adjacent stack memory including the return address, causing a crash (DoS) or, with further exploitation techniques, potentially redirecting execution flow for code execution (GitHub Issue, PoC File).

• Process: MP4Box process crashing or terminating abnormally with a segmentation fault or SIGABRT when processing SWF files.
• Logs: AddressSanitizer output referencing stack-buffer-overflow in swf_def_bits_jpeg at scene_manager/swf_parse.c:2120; error messages from __interceptor_vsprintf or __interceptor_sprintf.
• File System: Presence of unusually deeply nested directory structures (1000+ character paths) containing .swf files in directories used as input to MP4Box.
• Process: Unexpected child processes or crash dump files generated by the MP4Box process during SWF import operations (GitHub Issue).

The GPAC project has released a patch (commit 8961c74f87ae3fe2d3352e622f7730ca96d50cf1) that replaces all unsafe sprintf calls in swf_parse.c with snprintf using GF_ARRAY_LENGTH(szName) as the size limit, preventing the overflow (GPAC Commit). Users should update to a GPAC build that includes this commit. As a workaround, avoid processing untrusted SWF files with MP4Box, and restrict the length of file paths used as input to MP4Box operations.