Is CVE-2026-108538 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108538 being exploited in the wild.

How severe is CVE-2026-108538?

Medium severity, with a CVSS score of 6.3, published 11 October 2026.

Which products and versions are affected?

GPAC Project GPAC up to 26.07.0.

Is there a fix for CVE-2026-108538?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108538 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108538?

Check whether you run GPAC Project GPAC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108538: GPAC MP4Box use-after-free in gf_mx_v

CVE-2026-108538 · Severity: medium · CVSS 6.3 · Published 2026-10-11

GPAC is a multimedia framework used for handling video and audio files, with MP4Box being a component that processes MP4 files. A use-after-free vulnerability in the gf_mx_v function allows an attacker to execute arbitrary code or crash the application by processing a maliciously crafted media file remotely. The exploit has been publicly disclosed and could lead to data corruption, denial of service, or code execution.

Vendors: GPAC Project.

Quick answers

Is CVE-2026-108538 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108538 being exploited in the wild.
How severe is CVE-2026-108538?: Medium severity, with a CVSS score of 6.3, published 11 October 2026.
Which products and versions are affected?: GPAC Project GPAC up to 26.07.0.
Is there a fix for CVE-2026-108538?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108538 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108538?: Check whether you run GPAC Project GPAC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the gf_mx_v function within utils/os_thread.c in GPAC's MP4Box component. The vulnerability can be triggered remotely by processing a malicious MP4 file, requiring no authentication or user interaction beyond opening the file. An attacker can leverage this to achieve code execution or denial of service.

Affected products

GPAC Project GPAC up to 26.07.0

Timeline

2026-10-11: disclosed: Vulnerability publicly disclosed; vendor unresponsive

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.