CVE-2026-7135: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-7135 is a heap out-of-bounds read (and potential write) vulnerability in GPAC's MP4Box component, caused by an integer truncation bug in the elng_box_read() function within src/isomedia/box_code_base.c. It affects GPAC up to version 26.03-DEV-rev105-g8f39a1eb3-master. The vulnerability was reported on April 8, 2026, and published to NVD and the GitHub Advisory Database on April 27, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (Github Advisory, Feedly).

The root cause is a u64→u32 integer truncation (CWE-125, CWE-119) in elng_box_read(). When parsing an ISOBMFF elng (Extended Language) box that uses the largesize extension with a 64-bit size value (e.g., 0x10000000C), the function casts ptr->size to u32 for gf_malloc() and gf_bs_read_data(), allocating only 12 bytes. However, lines 3688 and 3692 use the original uncasted u64 value as an array index, resulting in a heap read approximately 4 GB past the allocated buffer and a potential null-byte write at the same offset. The attack requires a crafted MP4 file with a largesize-extended elng box nested inside moov → extk → elng; on Linux, a sparse file is used to satisfy the gf_bs_available() guard that would otherwise reject the oversized box. A detailed PoC script (poc_elng.py) and full ASAN crash output were published in the GitHub issue (GPAC Issue #3516, GPAC Commit).

Successful exploitation can result in heap memory disclosure approximately 4 GB past the allocated buffer, potentially leaking sensitive data from adjacent memory mappings (confidentiality impact). If execution reaches the write path, a null byte is written ~4 GB past a second heap allocation, enabling potential heap metadata corruption (integrity impact). The crash is 100% reproducible, causing a denial of service for any service or application that parses untrusted MP4 files using libgpac (availability impact) (GPAC Issue #3516).

A public proof-of-concept Python script (poc_elng.py) was included in the original GitHub issue report and is available to the public, lowering the barrier to exploitation (GPAC Issue #3516). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is approximately 0.013% (4th percentile), indicating low current probability of widespread exploitation. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Craft a malicious MP4 file: Use the published poc_elng.py script to generate a crafted MP4 file containing a moov → extk → elng box hierarchy where the elng box uses the ISOBMFF largesize extension with a 64-bit size value (e.g., ELNG_LARGESIZE = 0x100000020), resulting in ptr->size = 0x10000000C (u64) but only 12 bytes allocated after truncation.
2. Create a sparse file: On Linux (ext4/xfs/btrfs), extend the crafted file to 8 GB using os.truncate(OUT, 0x200000000). This causes gf_bs_available() to return ~8 GB (based on fstat().st_size), bypassing the INCOMPLETE_FILE guard in gf_isom_box_parse_ex() without consuming real disk space.
3. Deliver the file to the target: Provide the crafted MP4 file to a system running a vulnerable version of GPAC/MP4Box (≤ 26.03-DEV-rev105-g8f39a1eb3-master), either directly or via an application that uses libgpac for MP4 parsing.
4. Trigger parsing: Execute MP4Box -info poc_elng.mp4 or any libgpac-based application that opens the file. The elng_box_read() function is invoked with the full u64 ptr->size, allocates only 12 bytes, then indexes ~4 GB past the buffer.
5. Achieve OOB read/write: The process crashes with SIGSEGV (confirmed by ASAN output), leaking heap memory contents or corrupting heap metadata if the write path is reached (GPAC Issue #3516).

• File System: Presence of crafted MP4 files with unusually large logical file sizes (e.g., 8 GB) but minimal real disk usage (e.g., ~4 KB), indicative of Linux sparse files used to trigger the vulnerability.
• Process: Crashes or SIGSEGV signals originating from elng_box_read() within libgpac.so; ASAN output referencing elng_box_read in the stack trace with register values showing rax = 0x000000010000000c and rdi = 0x000000010000000b.
• Logs: Application crash logs or core dumps from MP4Box or libgpac-linked applications when processing MP4 files containing elng boxes with largesize headers; error messages referencing gf_isom_box_parse_ex or gf_isom_box_array_read (GPAC Issue #3516).

The GPAC project has released a fix in commit cf6ac48c972eaaee2af270adc3f36615325deb3e, which adds an upper-bound check (if (ptr->size > GF_UINT_MAX) return GF_ISOM_INVALID_FILE;) before any memory allocation in elng_box_read(). Users should upgrade to a version of GPAC that includes this patch; the fix is present in the abi-16.8 release tag and later (GPAC Commit, GPAC Release). As a workaround, restrict local access to systems running vulnerable GPAC versions and avoid processing untrusted MP4 files with unpatched builds. Apply the principle of least privilege to limit exposure of MP4Box functionality.