Description

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T02:17:15.533Z",
  "pubdate": "2026-09-14T02:17:15.533Z",
  "executiveSummary": "A reachable assertion vulnerability exists in the MP4Box component of GPAC, specifically within the gf_sm_dump_command_list function located in scene_manager/scene_dump.c.\nThis vulnerability, affecting versions up to f1219cde, allows an attacker to trigger an assertion failure, leading to a denial-of-service (DoS) condition.\nThe flaw necessitates local access to the system, where an attacker can execute the exploit against a target MP4Box instance.\nWhile the vulnerability is local, the availability of public exploits increases the risk of successful weaponization by malicious actors.\nThe primary impact is the abnormal termination of the MP4Box process, which can disrupt services relying on the component for multimedia processing.\nGPAC has addressed this issue in version abi-16.23 via patch afca1f1181668d85941d51ed1adf647807d5d975; immediate upgrading is highly recommended.",
  "technicalDetails": "The vulnerability resides in the gf_sm_dump_command_list function within the file scene_manager/scene_dump.c of the MP4Box component. The root cause is a logic error that triggers a reachable assertion within the scene management dump routine. Assertions in C are typically intended for debugging purposes to verify assumptions about the program state; if a condition evaluated within an assert() macro is false, the application terminates immediately via abort().\nIn the context of MP4Box, the processing of specific, maliciously crafted scene data causes the program to reach an invalid state that the developer explicitly constrained with an assertion. When the function processes this malformed input, the internal logic flow encounters a state that violates the integrity requirements of the command list dumping process. Because the check is performed using an assertion rather than a graceful error-handling routine, the runtime environment forces the termination of the process upon detection of the unexpected state.\nThe attack flow requires an adversary to have local access to the system. The attacker must supply a specifically crafted multimedia file to the MP4Box utility. When the utility attempts to process this file, it invokes the vulnerable gf_sm_dump_command_list function to parse or dump the scene command list. The crafted input triggers the assertion violation, leading to an immediate process crash.\nThis issue is exploitable because the program state is not properly validated before entering the code path containing the assertion. The lack of robust input validation or safe error propagation means that the application does not have a mechanism to recover from this condition, resulting in a denial-of-service. Since public exploits are available, an attacker can leverage pre-existing code to craft the necessary inputs to reliably trigger this crash.\nThe impact is strictly limited to local denial-of-service, as the termination prevents the utility from completing its task. There is no evidence currently suggesting that this assertion failure leads to arbitrary code execution, privilege escalation, or memory corruption that could be leveraged for remote persistence. However, in environments where MP4Box is used as part of a larger automated processing pipeline, the resulting crash can disrupt service availability and stability."
}