CVE-2026-1418
📋 TL;DR
This CVE describes an out-of-bounds write vulnerability in GPAC's SRT subtitle import function. Attackers with local access can exploit this to potentially execute arbitrary code or crash the application. Users of GPAC up to version 2.4.0 are affected.
💻 Affected Systems
- GPAC
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise if exploited by a malicious user with local access.
Likely Case
Application crash (denial of service) or limited code execution in the context of the GPAC process.
If Mitigated
No impact if proper access controls prevent local users from running malicious subtitle files.
🎯 Exploit Status
Exploit has been publicly disclosed and requires local access to execute malicious subtitle files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 10c73b82cf0e367383d091db38566a0e4fe71772
Vendor Advisory: https://github.com/gpac/gpac/issues/3425
Restart Required: Yes
Instructions:
1. Update GPAC to version after 2.4.0 or apply commit 10c73b82cf0e367383d091db38566a0e4fe71772. 2. Rebuild from source if using custom build. 3. Restart any GPAC processes.
🔧 Temporary Workarounds
Disable SRT subtitle processing
allPrevent GPAC from processing SRT subtitle files to mitigate the vulnerability
Configure GPAC to reject SRT subtitle files or disable subtitle import functionality
Restrict file access
linuxLimit local user access to subtitle files and GPAC executable
chmod 750 /path/to/gpac
chown root:root /path/to/gpac
🧯 If You Can't Patch
- Implement strict access controls to prevent local users from running malicious subtitle files
- Monitor for suspicious subtitle file processing and GPAC crashes
🔍 How to Verify
Check if Vulnerable:
Check GPAC version with 'gpac -version' or 'gpac --version' and verify if it's 2.4.0 or earlierCheck Version:
gpac -versionVerify Fix Applied:
Verify GPAC version is newer than 2.4.0 or check if commit 10c73b82cf0e367383d091db38566a0e4fe71772 is applied in source builds📡 Detection & Monitoring
Log Indicators:
- GPAC process crashes when processing subtitle files
- Unexpected memory access errors in system logs
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process:gpac AND (EventID:1000 OR EventID:1001) OR FilePath:*.srt AND Process:gpac🔗 References
- https://github.com/enocknt/gpac/commit/10c73b82cf0e367383d091db38566a0e4fe71772
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/issues/3425
- https://github.com/gpac/gpac/issues/3425#issue-3801961068
- https://vuldb.com/?ctiid.342807
- https://vuldb.com/?id.342807
- https://vuldb.com/?submit.736544
