Executive brief
GPAC is a multimedia framework used for processing and packaging video files. A vulnerability in its MP4Box tool allows an attacker to crash the application by providing a specially crafted media file. This could lead to a denial of service, disrupting media processing workflows or automated video conversion services.
Technical details
A use-after-free vulnerability exists in the gf_filter_pid_reconfigure_task_discard function within /filter_core/filter_pid.c of the GPAC Project. The issue is triggered when processing crafted MPEG-2 TS files containing corrupted PMT descriptors and invalid packets, which leads to the application accessing a freed memory area in the pid_inst structure. An attacker can exploit this by supplying a malicious media file to the MP4Box utility, resulting in a crash (Denial of Service). The vulnerability was addressed by implementing a state check (discard_inputs) to ensure the PID instance is only deleted when it is safe to do so.
Affected products
- GPAC GPAC Project / MP4Box before 26.02.0
Timeline
- 2026-06-24: disclosed: CVE published to NVD dataset
- 2026-06-24: advisory
References
- https://github.com/gpac/gpac/commit/868c6801c226e9964cace54cfd5a759f152780b4
- https://github.com/gpac/gpac/issues/3279
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/31/31_gf_filter_pid_reconfigure_task_discard_filter_core_filter_pid_c_1341
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/31/README.md
- https://infosec.exchange/@sigdevel/116778301425195980