Executive brief
GPAC is an open-source multimedia framework used for video streaming, transcoding, and packaging. MP4Box is a command-line tool within GPAC for manipulating MP4 files. A reachable assertion vulnerability in the LSR command parser can cause MP4Box to crash when processing malformed LSR-encoded media files, leading to denial of service of the tool's functionality.
Technical details
A reachable assertion exists in the lsr_exec_command_list function within laser/lsr_dec.c of GPAC's MP4Box component. The vulnerability is triggered during the parsing of LSR (Lightweight Scene Representation) command data and allows a local attacker with access to craft malicious LSR-encoded files to trigger the assertion, causing abnormal termination. Local file access is required; the vulnerability cannot be exploited remotely. The issue was addressed in commit afca1f1181668d85941d51ed1adf647807d5d975 and patch is available in version abi-16.23 or later.
Affected products
- GPAC GPAC up to f1219cde
Timeline
- 2026-09-14: disclosed
- 2026-07-27: patched: Patch commit afca1f1181668d85941d51ed1adf647807d5d975 authored; version abi-16.23 or later contains fix