Description
GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks being modified, this could lead to RCE. This attack appear to be exploitable via an attacker supplied MP4 file that when run by the victim may result in RCE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | gpac | 0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1 | USN-3926-1 |
| Ubuntu 16.04 LTS | gpac | 0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1 | USN-3926-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | 0.5.0+svn4288~dfsg1-4ubuntu1+esm1 | — |
Advisories 1
- USN-3926-1 gpac vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- https://github.com/gpac/gpac/issues/994
- USN-3926-1 vendor-advisory