Executive brief
GPAC is an open-source multimedia framework used for video streaming and transcoding. A use-after-free vulnerability in the MP4Box component can be triggered through local manipulation, potentially causing application crashes or unexpected behavior. The issue has been publicly disclosed and patched.
Technical details
A use-after-free vulnerability exists in the gf_node_deactivate_ex function within src/scenegraph/base_scenegraph.c of GPAC's MP4Box component. The vulnerability is triggered through local manipulation of memory references. Attack requires local access to the affected system. An attacker can cause the application to crash or potentially execute arbitrary code by exploiting the freed memory reference. A fix is available in version abi-16.24 or later (commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7).
Affected products
- GPAC Project GPAC 26.08-DEV and earlier
Timeline
- 2026-09-16: disclosed
- 2026-08-03: patched