CVE-2026-13523: GPAC ISOBMFF Parser Decompression Denial-of-Service Vulnerability

Technical summary

CVE-2026-13523 affects the base_encoding.c component of GPAC's ISOBMFF parser. The weakness (CWE-404: Improper Resource Validation, CWE-409: Improper Handling of Highly Compressed Data) allows an attacker to manipulate compressed data structures within media files, causing decompression to expand far beyond the input size. The vendor's mitigation implements a deflate output size ceiling of 32 times the compressed input; further adjustment of this threshold is under consideration. The patch (commit 297f2d8d1f493d8b241330533cd47f7da758aeb3) adds explicit validation to prevent runaway decompression.

Business impact

This vulnerability poses a localized denial-of-service risk to organizations relying on GPAC for media processing. Organizations that deploy GPAC in automated transcoding pipelines, media analysis workflows, or shared computing environments may experience service disruption if untrusted or user-supplied media files are processed without additional validation. The low CVSS score reflects the local-only requirement, but the availability impact could disrupt dependent workflows or consume computational resources in resource-constrained environments.

Affected systems

GPAC (GNU Portable Multimedia Library) versions up to and including 26.02.0 are affected. The vulnerability resides in the ISOBMFF parser, so systems using GPAC to decode, process, or analyze ISO-format media files (MP4, MOV, etc.) are in scope. The attack surface is limited to scenarios where GPAC is accessible to a local user or where untrusted media files can be supplied to a GPAC-based service.

Exploitability

Active exploitation of this vulnerability is feasible but constrained by access requirements. The flaw requires local system access and the ability to supply a crafted media file to GPAC for processing. Public disclosure of this vulnerability means attack code or proof-of-concept files may be available, but the local-only nature and dependency on file format manipulation reduce the likelihood of widespread automated exploitation. Organizations with strict local access controls or those processing only trusted media sources face minimal immediate risk.

Remediation

Apply the patch identified by commit 297f2d8d1f493d8b241330533cd47f7da758aeb3 to GPAC. Verify the patch version against official GPAC release notes or repository updates. If patching is not immediately feasible, implement input validation and file format verification before passing media files to GPAC, and restrict local GPAC access to trusted users. Consider isolating GPAC services in containerized or sandboxed environments to mitigate resource exhaustion.

Patch guidance

Obtain the patch from the official GPAC repository corresponding to commit 297f2d8d1f493d8b241330533cd47f7da758aeb3. Verify the patch applies cleanly to your version of GPAC and review the vendor's notes regarding the 32x decompression threshold. Test patched builds against your organization's media workflows to ensure no regression. Given the low CVSS score and local-only attack vector, patching can be scheduled within normal maintenance windows unless your environment processes untrusted media files at scale.

Detection guidance

Monitor GPAC process behavior for anomalous memory or CPU consumption when processing media files, particularly rapid spikes in resource usage during file parsing. Log file access patterns for ISOBMFF media files, especially those from untrusted sources. Implement application-level logging in GPAC if available to capture decompression failures or validation errors post-patch. File integrity monitoring on media processing directories can help detect injection of malicious test cases.

Why prioritize this

Although the CVSS score is low (3.3), this vulnerability warrants attention in environments where GPAC processes user-supplied or untrusted media. Organizations with automated media pipelines, media streaming services, or collaborative media platforms should prioritize patching to prevent denial-of-service scenarios. Conversely, organizations using GPAC only with internally-curated, trusted media sources may defer patching to scheduled maintenance cycles. The availability impact and public exploit availability justify near-term remediation planning.

Risk score, explained

The CVSS 3.1 score of 3.3 (Low) reflects the local attack vector (AV:L), low attack complexity (AC:L), requirement for local privileges (PR:L), and the absence of confidentiality or integrity impact. The severity is driven solely by availability loss (A:L). The low score appropriately captures that this is not a remote or unauthenticated threat, though in specific operational contexts the business impact may feel higher if service continuity depends on uninterrupted media processing.

Frequently asked questions