Executive brief
GPAC is an open-source multimedia framework used for video streaming, transcoding, and media processing. MP4Box is its command-line tool for manipulating MP4 files. A local out-of-bounds memory read vulnerability in the node deletion function could allow an attacker who can execute code locally to read sensitive data from memory or crash the application.
Technical details
An out-of-bounds read vulnerability exists in the gf_node_del function within scenegraph/base_scenegraph.c of GPAC's MP4Box component. The vulnerability is triggered during MP4 file processing and requires local code execution to exploit. An attacker must be able to supply a malformed MP4 file and execute MP4Box locally to trigger the out-of-bounds read, potentially leading to information disclosure or denial of service. The issue has been patched in version abi-16.23 (commit afca1f1181668d85941d51ed1adf647807d5d975).
Affected products
- GPAC MP4Box 26.07.0
Timeline
- 2026-09-14: disclosed
- 2026-07-27: patched: Patch commit afca1f1181668d85941d51ed1adf647807d5d975