ANT-2026-B4Z27MGE: gpac/fuzz_route/20251128_202533_unknown/

GPAC's DASH manifest handling extracts the printf-style specifier from segment templates such as $Number%05d$ and uses it directly as the format argument to sprintf when resolving segment URLs. The prior sanity check only verified that a 'd', 'i' or 'u' character appeared somewhere in the string, so specifiers like %n, %s or multiple conversions were accepted. The same untrusted-format pattern exists in gf_mpd_resolve_subnumber and in the ROUTE/ATSC3 STSID TOI-template parser. An attacker who serves a malicious MPD manifest or ROUTE STSID can therefore inject an arbitrary format string, leading to memory corruption or information disclosure when the template is expanded.

Target

Project: gpac
Location: src/media_tools/route_dmx.c:gf_route_service_setup_stsid (unvalidated printf format specifier from S-TSID TOI template; shared root cause also in src/media_tools/mpd.c:gf_mpd_resolve_url)
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The root cause is that an attacker-controlled string is used as the format parameter of sprintf. The old guard if (!strchr(szPrintFormat,'d') && !strchr(szPrintFormat,'i') && !strchr(szPrintFormat,'u')) strcat(szPrintFormat,"d"); does not restrict the string to a single integer conversion, so payloads such as %n%d or %4919$s pass validation. In gf_mpd_resolve_subnumber the specifier was passed to sprintf with no validation at all.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-B4Z27MGE.

---

Reference: ANT-2026-B4Z27MGE
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

{
  "ant_id": "ANT-2026-B4Z27MGE",
  "bug_class": null,
  "claude_severity": "high",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:34+00:00",
  "description": "GPAC's DASH manifest handling extracts the printf-style specifier from segment templates such as $Number%05d$ and uses it directly as the format argument to sprintf when resolving segment URLs. The prior sanity check only verified that a 'd', 'i' or 'u' character appeared somewhere in the string, so specifiers like %n, %s or multiple conversions were accepted. The same untrusted-format pattern exists in gf_mpd_resolve_subnumber and in the ROUTE/ATSC3 STSID TOI-template parser. An attacker who serves a malicious MPD manifest or ROUTE STSID can therefore inject an arbitrary format string, leading to memory corruption or information disclosure when the template is expanded.",
  "discovered_at": "2025-11-28T00:00:00+00:00",
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "GPAC",
  "reproduction": null,
  "technical_details": "The root cause is that an attacker-controlled string is used as the format parameter of sprintf. The old guard `if (!strchr(szPrintFormat,'d') && !strchr(szPrintFormat,'i') && !strchr(szPrintFormat,'u')) strcat(szPrintFormat,\"d\");` does not restrict the string to a single integer conversion, so payloads such as `%n%d` or `%4919$s` pass validation. In gf_mpd_resolve_subnumber the specifier was passed to sprintf with no validation at all.",
  "title": "gpac/fuzz_route/20251128_202533_unknown/",
  "vendor_severity": null
}