Executive brief
GPAC's MP4Box is a multimedia packaging and transcoding tool used to process video and media files. A use-after-free vulnerability in list management allows a local attacker to manipulate memory, potentially causing crashes or arbitrary code execution when processing specially crafted media files.
Technical details
The vulnerability is a use-after-free flaw in the gf_list_count function located in utils/list.c of the MP4Box component. The attack vector is local execution only, meaning an attacker must have access to the system running MP4Box. The vulnerability can be triggered by providing a specially crafted input that manipulates list structures, leading to access of freed memory. A patch is available in commit 49dee5cad329cfed310c1682703df7daa47df31a and upgrading to version abi-16.23 or later resolves the issue.
Affected products
- GPAC MP4Box up to f1219cde
Timeline
- 2026-09-13: disclosed
- 2026-07-28: patched: commit 49dee5cad329cfed310c1682703df7daa47df31a