3860

This vulnerability was identified with the assistance of AI-based code analysis tools.

Supplier : GPAC - Source :

A heap buffer overflow vulnerability exists in the rmt_client_handle_ws_frame function in src/utils/rmt_ws.c . When processing WebSocket frames with a large payload size (using extended 64-bit length encoding), the payload_size value wraps to 0 in u64 arithmetic when computing the allocation size ( payload_size * sizeof(u8) + 1 ), causing gf_malloc to allocate a zero-size buffer. The subsequent loop then writes out-of-bounds to this buffer.

GPAC v26.07.0 (commit 2d7da22 ) and master HEAD ( 6fed75d ). All line numbers refer to this commit. No fix commit identified at the time of reporting.

Vulnerability Details

Trigger Path (confirmed via ASAN)

Environment : x86_64 Linux, GCC 15. GPAC built with export CFLAGS='-Wno-implicit-function-declaration' && ./configure --extra-cflags='-fsanitize=address -g -O1' --extra-ldflags='-fsanitize=address' && make -j4 .

Attached file: poc_rmt_ws_malicious_frame.py — generates a malicious WebSocket frame with payload_size=0xFFFFFFFFFFFFFFFF.

Expected ASAN output:

An attacker who can reach the WebSocket remote management service (port 6363, enabled via sys.enable_rmtws() JS call) can trigger a heap buffer overflow by sending a single crafted WebSocket frame, causing a crash, with potential for arbitrary code execution due to ~1KB of attacker-controlled heap memory corruption. Practical exploitability is constrained by glibc 2.34+ heap protections, but the worst-case impact remains code execution.

The rmt_ws WebSocket remote management service is disabled by default. It requires an explicit sys.enable_rmtws() call in a JavaScript file—the default GPAC installation does not include this call. An administrator must deliberately modify or create a JS script to enable the service.

GPAC version: v26.07.0 ( 2d7da22 ), master HEAD ( 6fed75d )

OS: Linux x86_64, Ubuntu 26.04

Compiler: GCC 15.2.0 with ASan