CVE-2026-4185 | GPAC up to 2.5-DEV-rev2167-gcc9d617c0-master MP4Box swf_parse.c swf_def_bits_jpeg szName stack-based overflow (Issue 3436)

A vulnerability described as critical has been identified in GPAC up to 2.5-DEV-rev2167-gcc9d617c0-master. This vulnerability affects the function swf_def_bits_jpeg of the file src/scene_manager/swf_parse.c of the component MP4Box. The manipulation of the argument szName results in stack-based buffer overflow.

This vulnerability is known as CVE-2026-4185. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A patch should be applied to remediate this issue.