Executive brief
A vulnerability exists in GPAC's MP4Box, a popular tool for processing and packaging multimedia files. By tricking a user into opening a specially crafted media file, an attacker can cause the application to crash. This results in a denial-of-service, potentially disrupting media processing workflows or automated content pipelines.
Technical details
A use-after-free vulnerability exists in the gf_filter_pid_inst_swap_delete_task function within /filter_core/filter_pid.c of GPAC. The issue occurs during filter teardown operations when the task scheduler attempts to process a deleted filter instance (GF_FilterPidInstance) after its memory has been released. An attacker can exploit this by providing a malformed media file (such as a crafted MPEG-2 TS file) that triggers specific filter reconfiguration errors. This leads to an invalid memory access and subsequent application crash (Denial of Service). The vulnerability is addressed in version 26.02.0 and via specific commits to the GPAC repository.
Affected products
- GPAC Project GPAC / MP4Box before 26.02.0
Timeline
- 2026-06-24: advisory: NVD publication date
- 2026-06-24: disclosed: Public disclosure of the vulnerability and PoC
References
- https://github.com/gpac/gpac/commit/976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77
- https://github.com/gpac/gpac/issues/3286
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/37/37_gf_filter_pid_inst_swap_delete_task_filter_core_filter_pid_c_574
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/37/README.md
- https://infosec.exchange/@sigdevel/116780518074911144