Executive brief
GPAC is a multimedia framework that includes MP4Box, a utility for processing and creating MP4 video files. A vulnerability in MP4Box's scene graph processing allows an attacker to send a specially crafted XMT scene file that causes the application to reference freed memory, crashing the process and potentially enabling memory corruption attacks.
Technical details
The vulnerability is a use-after-free (CWE-416) in the gf_sg_script_load function within scenegraph/vrml_tools.c. While parsing malformed XMT scene files, the xmt_node_end function in loader_xmt.c can discard and free a Script node, but a dangling pointer to that node is queued for later processing. When gf_sg_command_apply calls gf_sg_script_load with the freed pointer, a heap-use-after-free read occurs. The vulnerability is remotely triggerable via a crafted XMT file passed to MP4Box. The attack requires network or local file access to provide the malicious XMT input. The fix (commit 9eb40df4) tracks whether a node was discarded and prevents queuing freed nodes for deferred script loading. Upgrade to version abi-16.23 or later to remediate.
Affected products
- GPAC MP4Box up to f1219cde
Timeline
- 2026-09-14: disclosed
- 2026-07-27: patched: Fix commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24