Executive brief
GPAC is an open-source multimedia framework used for video streaming, transcoding, and packaging. A flaw in the MP4Box component allows local attackers to trigger a crash via a malformed MP4 file, disrupting service availability but not enabling data theft or privilege escalation.
Technical details
The vulnerability is a reachable assertion in the stbl_GetSampleInfos function within isomedia/stbl_read.c of the MP4Box component. An attacker with local access can craft a malicious MP4 file that causes the assertion to be triggered, resulting in a denial of service. The attack vector is local and requires no authentication. The issue is addressed in GPAC version abi-16.23 via commit 49dee5cad329cfed310c1682703df7daa47df31a.
Affected products
- GPAC GPAC up to f1219cde, before abi-16.23
Timeline
- 2026-09-14: disclosed
- 2026-07-28: patched