Buffer Overflow in GPAC via j2kdec_process Function

Executive Summary

CVE-2026-71613 is a heap buffer overflow in the GPAC multimedia framework affecting the j2kdec_process function. It occurs when processing a maliciously crafted JP2 file where the header declares small dimensions but the codestream declares large dimensions. This mismatch causes an undersized buffer allocation that is later overflowed by actual pixel data, leading to potential arbitrary code execution or denial-of-service attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for crashes or segmentation faults when processing JP2 files with GPAC. Check for unusually large memory allocations or buffer overflow warnings in logs. Use tools like AddressSanitizer (ASan) or Valgrind to detect heap overflows during file processing. Example commands: 'gpac -i poc.jp2' to test with a crafted file, or 'valgrind --tool=memcheck gpac -i test.jp2' to detect memory issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary code or crash applications by processing specially crafted JP2 files. Users running vulnerable GPAC versions may experience system instability, unauthorized code execution, or denial-of-service conditions when opening malicious media files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or arbitrary code execution. If exploited, it may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations. Additionally, the lack of proper input validation could result in data integrity issues, further compromising compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GPAC to the patched version (commit 9a253a07fd3f6b48022bba74302bf39388dda859 or later). Avoid processing untrusted JP2 files, especially those with mismatched dimensions between JP2 headers and JPEG-2000 codestreams. Implement input validation to reject files with inconsistent dimensions. Disable or restrict GPAC in environments where untrusted media processing is required.

Useful 0 Not Useful 0