Executive brief
A vulnerability exists in GPAC's MP4Box, a popular tool for processing and editing multimedia files. By tricking a user into opening a specially crafted media file, an attacker can cause the application to crash or behave unexpectedly. This can lead to a denial of service, disrupting media processing workflows and potentially impacting operations that rely on automated video conversion.
Technical details
A use-after-free vulnerability exists in the gf_filter_pid_inst_swap function within /filter_core/filter_pid.c of GPAC Project/MP4Box. The root cause is a failure to reset the ctx->pid_inst pointer to NULL after calling gf_free(), leading to a dangling pointer. When subsequent operations, such as PID reconfiguration, attempt to dereference this pointer, memory corruption occurs. An attacker can exploit this by providing a maliciously crafted media file to be processed by MP4Box, resulting in a crash (Denial of Service). The issue is addressed in version 26.02.0 and later.
Affected products
- GPAC GPAC Project / MP4Box before 26.02.0
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory
References
- https://github.com/gpac/gpac/commit/55b351bd078c950592544ab4c708a613c1725b9b
- https://github.com/gpac/gpac/issues/3283
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/34/34_gf_filter_pid_inst_swap_filter_core_filter_pid_c_633
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/34/README.md
- https://infosec.exchange/@sigdevel/116778494176930561