Executive brief
GPAC is an open-source multimedia framework used for video streaming and content transcoding. A use-after-free vulnerability in its scene graph parser could allow a remote attacker to crash the application or potentially execute arbitrary code by crafting a malicious multimedia file.
Technical details
The vulnerability is a use-after-free flaw in the gf_node_get_name_and_id function in scenegraph/base_scenegraph.c. The root cause involves improper memory management where a previously freed memory region is accessed. The attack vector is remote and does not require authentication; an attacker can trigger the vulnerability by providing a specially crafted multimedia file to an application using the affected GPAC library. Exploitation could result in denial of service (crash) or potentially arbitrary code execution. The issue has been patched; upgrading to version abi-16.23 or applying commit 49dee5cad329cfed310c1682703df7daa47df31a is recommended.
Affected products
- GPAC GPAC up to f1219cde
Timeline
- 2026-09-15: disclosed
- 2026-07-28: patched: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a; fixed in version abi-16.23