Executive brief
GPAC MP4Box, a popular open-source tool for processing multimedia files, contains a vulnerability that can be triggered by a specially crafted video file. If a user processes a malicious MPEG-2 TS or MP4 file, the application may crash, leading to a denial of service. This could disrupt media processing workflows or automated video conversion services.
Technical details
A heap use-after-free vulnerability exists in GPAC MP4Box version 2.5-DEV-rev1593-gfe88c3545-master within the gf_filter_pid_inst_swap_delete_task() function in filter_core/filter_pid.c. The issue occurs when the application improperly accesses objects that have already been freed during PID instance swap or delete cleanup operations. An attacker can exploit this by providing a malformed MPEG-2 TS or MP4 file, which triggers the use-after-free during filter teardown. This results in a memory corruption and a subsequent crash (denial of service). Fixes have been identified in the GPAC GitHub repository via commits 976dacf and aed9c94.
Affected products
- GPAC Multimedia Open Source Project GPAC/MP4Box 2.5-DEV-rev1593-gfe88c3545-master
Timeline
- 2026-06-24: advisory: NVD publication date
- 2026-06-24: disclosed
References
- https://github.com/gpac/gpac/commit/976dacf65cb6986a4e4f350fb8d3ed0a17dc3a77
- https://github.com/gpac/gpac/commit/aed9c94e92e8ba362ddb29c767c519478f46f195
- https://github.com/gpac/gpac/issues/3290
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/39/39_gf_filter_pid_inst_swap_delete_task_filter_core_filter_pid_c_580
- https://infosec.exchange/@sigdevel/116780598378458041