Executive brief
A vulnerability exists in GPAC's MP4Box, a popular tool for processing and editing multimedia files. By tricking a user into opening a specially crafted media file, an attacker can cause the application to crash. This results in a denial of service, potentially disrupting media processing workflows or automated content pipelines.
Technical details
A use-after-free (UAF) vulnerability exists in the gf_filter_pid_get_packet function within /filter_core/filter_pid.c of GPAC. The issue occurs when the filter pipeline attempts to access a Packet ID (PID) object that has already been freed, particularly during tasks where a target filter or PID was marked for removal. An attacker can exploit this by providing a malformed media file (e.g., MPEG-2 TS) that triggers the unexpected state during processing. This leads to memory corruption and an application crash (Denial of Service). The vulnerability was addressed in commit 4a7ea06 by adding checks to ignore tasks for PIDs marked for removal.
Affected products
- GPAC GPAC Project / MP4Box before 26.02.0
Timeline
- 2026-06-24: disclosed
- 2026-06-25: advisory
References
- https://github.com/gpac/gpac/commit/4a7ea06dd1b2cc65fe0dabc60189eb6bc814f7bb
- https://github.com/gpac/gpac/issues/3284
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/35_gf_filter_pid_get_packet_filter_core_filter_pid_c_6827
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/README.md
- https://infosec.exchange/@sigdevel/116780402249845037