Executive brief
GPAC is a multimedia framework used for video streaming and transcoding. A use-after-free vulnerability in the Proto Link Handler component could allow an attacker with local access to crash the application or potentially execute code, affecting systems that process GPAC files or streams.
Technical details
A use-after-free vulnerability exists in the gf_inline_get_proto_lib function within src/compositor/mpeg4_inline.c of GPAC's Proto Link Handler component. The flaw results from improper memory management where a pointer is dereferenced after the object it points to has been freed. The vulnerability requires local access and can be triggered through crafted GPAC media files. An attacker exploiting this issue can cause a denial-of-service crash. A patch is available in commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7, and upgrading to version abi-16.24 or later mitigates the issue.
Affected products
- GPAC GPAC 26.08-DEV
Timeline
- 2026-09-16: disclosed
- 2026-08-03: patched: Commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7