Description

A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T02:17:15.357Z",
  "pubdate": "2026-09-14T02:17:15.357Z",
  "executiveSummary": "A reachable assertion vulnerability exists within the GPAC multimedia framework, specifically affecting the MP4Box component.\nThe flaw originates in the xmt_parse_element function within scene_manager/loader_xmt.c, where improper handling of XMT (eXtensible MPEG-4 Textual) input data triggers an assertion failure.\nThis vulnerability leads to a denial-of-service (DoS) condition by causing the application to terminate unexpectedly when processing maliciously crafted XMT files.\nThe issue affects GPAC versions up to and including f1219cde.\nExploitation is limited to local execution, meaning an attacker must have access to the target system to trigger the vulnerability, typically by forcing the application to parse a malformed input file.\nBecause the exploit has been publicly disclosed, the risk of exploitation is elevated for systems that process untrusted media content.\nUsers are strongly advised to upgrade to version abi-16.23 to implement the official security fix provided by patch afca1f1181668d85941d51ed1adf647807d5d975.",
  "technicalDetails": "The vulnerability resides in the xmt_parse_element function, which is responsible for parsing XMT elements within the GPAC framework's scene manager. The root cause of this flaw is an inadequate validation of input data during the parsing process, which results in the triggering of an assertion.\nIn C-based applications, assertions are typically used for internal debugging to enforce invariants. When an assertion condition evaluates to false, the program calls abort(), leading to immediate process termination. In this specific case, the xmt_parse_element function encounters an unexpected state while interpreting the XML-based XMT structure. This indicates that the input provided does not conform to the expected schema or constraints anticipated by the developer, causing the logic to reach an unhandled state that triggers the assertion.\nThe attack flow requires an attacker to create a specially crafted XMT input file designed to trigger the specific path in the xmt_parse_element function that fails the assertion. Once the file is constructed, the attacker must execute the MP4Box component locally, passing the malicious file as an argument. Upon the component's attempt to parse the structure of the input, the internal validation logic fails, invoking the abort mechanism and causing the application to crash.\nThe vulnerable component is identified as the MP4Box binary within the GPAC ecosystem. Because the trigger occurs within a media-parsing routine, any user-supplied XMT file that hits the vulnerable parsing logic will reliably cause the crash. This represents a denial-of-service vector where a local attacker can disrupt media processing workflows.\nThe affected versions include all releases of GPAC up to commit f1219cde. The vulnerability does not require authentication or elevated privileges, provided the attacker has the ability to invoke the MP4Box executable with the malicious input file on the local file system. This vulnerability does not involve remote network exposure directly, as the attack is restricted to local execution. The primary post-exploitation impact is the disruption of the MP4Box process, preventing the legitimate completion of media processing tasks or secondary applications that rely on GPAC for parsing metadata."
}