CVE-2026-93331 in GPAC
Summary
by MITRE • 09/18/2026
A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. The affected component should be upgraded.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in GPAC version 26.08-DEV resides within the RTP Depacketizer component, specifically affecting the gf_rtp_parse_ttxt function located in src/ietf/rtp_depacketizer.c. This flaw is classified as an out-of-bounds read, which corresponds to CWE-125 in the Common Weakness Enumeration standard. An out-of-bounds read occurs when a program attempts to access memory locations that are outside the boundaries of the intended buffer or data structure. In this specific context, the vulnerability is triggered by improper validation or handling of the size argument passed to the function. When an attacker provides a crafted value for the size parameter during the parsing of Teletext (TTXT) RTP packets, the application may read memory beyond the allocated buffer limits. This type of error typically arises from insufficient boundary checks before performing memory access operations based on external input values.
The operational impact of this vulnerability is significant due to its remote exploitability. Since GPAC is a multimedia framework often used in streaming and broadcasting applications that process real-time transport protocol streams, an attacker can potentially trigger this flaw by sending specially crafted RTP packets over the network. The ability to launch the attack remotely means that no local access or user interaction is required for exploitation. While out-of-bounds reads primarily result in information disclosure rather than direct code execution, they can still lead to severe security consequences. An attacker could use this vulnerability to leak sensitive data from the application's memory space, such as cryptographic keys, session tokens, or other confidential information stored adjacent to the affected buffer. Furthermore, depending on how the leaked data is utilized and what subsequent actions are taken by the application logic, it may facilitate further attacks including denial of service through crashes or serve as a precursor for more complex exploitation chains involving heap corruption or arbitrary code execution if combined with other vulnerabilities.
From an offensive security perspective, this vulnerability aligns with techniques observed in advanced persistent threat campaigns where attackers probe network services for memory safety issues to gather intelligence about the target environment. It relates to ATT&CK technique T1046, Network Service Discovery, as it allows an attacker to potentially extract information from a running service over the network. The lack of strict input validation on critical parameters like size in low-level parsing functions is a common pattern exploited by automated fuzzing tools and manual penetration testers alike. Organizations relying on GPAC for media processing pipelines must recognize that even seemingly minor memory safety issues can compromise the confidentiality integrity, and availability of their systems if left unpatched.
To mitigate this risk, it is imperative to upgrade the affected component immediately. The vulnerability has been addressed in version abi-16.26 through a specific patch identified by commit hash 6bb0f64b4d1039c0fecd14ee2c1ee861d8661a68. This update likely introduces proper bounds checking and validation logic for the size argument within the gf_rtp_parse_ttxt function, ensuring that memory accesses remain strictly within allocated limits regardless of input values. In addition to applying this software upgrade, organizations should implement defense-in-depth strategies such as network segmentation to limit exposure of media processing services to untrusted networks. Deploying intrusion detection systems capable of identifying anomalous RTP packet patterns can also provide an additional layer of security monitoring. Regularly updating dependencies and conducting code reviews focused on memory safety practices are essential steps to prevent similar vulnerabilities in future development cycles.