Description

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16.23 can resolve this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T19:16:53.350Z",
  "pubdate": "2026-09-13T19:16:53.350Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability has been identified in the GPAC multimedia framework, specifically within the MP4Box utility. This memory corruption flaw resides in the gf_list_count function located in utils/list.c.\nThe vulnerability allows an attacker to trigger a use-after-free condition, which can result in arbitrary code execution or application crashes depending on the heap layout and subsequent memory access patterns.\nThe scope of impact is limited to local execution, requiring the attacker to have local access to the system to manipulate the application. This vulnerability affects all GPAC versions up to f1219cde.\nGiven that exploit code has been publicly disclosed, the risk profile is elevated, necessitating immediate attention.\nThe vulnerability is resolved in version abi-16.23 via the application of patch 49dee5cad329cfed310c1682703df7daa47df31a. Organizations relying on affected versions of MP4Box should prioritize upgrading to the patched release to mitigate the potential for unauthorized code execution.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) bug occurring within the GPAC multimedia framework, specifically within the MP4Box component. The core issue originates in the gf_list_count function defined in utils/list.c. A UAF vulnerability occurs when an application continues to use a pointer to a memory location after that memory has been deallocated or freed, often leading to unpredictable behavior, memory corruption, or controlled code execution.\nIn the context of the GPAC codebase, the gf_list_count function is responsible for returning the count of elements within a list structure. The UAF condition is triggered when the underlying list object is prematurely freed or its memory management logic is inconsistent, resulting in a dangling pointer. If the application attempts to reference this list structure—potentially via a sequence of manipulated inputs or specially crafted media files processed by MP4Box—the program will access memory that has already been returned to the heap allocator.\nThe attack flow requires the attacker to influence the state of the heap by orchestrating a specific sequence of operations that lead to the deallocation of the list structure while simultaneously keeping a reference to it active. Once the memory is freed, if an attacker can control the contents of the memory chunk before the dangling pointer is reused, they may achieve arbitrary code execution. This is typically accomplished by spraying the heap with attacker-controlled data that occupies the freed memory block, essentially overwriting object pointers or function pointers contained within the structure.\nBecause the exploit is restricted to local execution, an attacker must have access to the target environment where the MP4Box utility is executed. This could occur in scenarios where the utility is part of an automated processing pipeline, a web-based service that allows file uploads and processing via MP4Box, or a local multimedia editing environment. The presence of published exploit code significantly lowers the barrier to entry for potential adversaries, as the logic for triggering the UAF is already documented and available for weaponization.\nThe affected component is the MP4Box utility, and the vulnerability persists across all versions leading up to f1219cde. The exploit behavior centers on the exploitation of the heap manager's allocation/deallocation cycle, where the application's reliance on a list object's count function provides a gateway to trigger an insecure memory reference. Successful exploitation allows an attacker to divert execution flow, potentially leading to a full compromise of the application's process context, depending on the system's underlying memory protections."
}