Description

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T02:17:15.690Z",
  "pubdate": "2026-09-14T02:17:15.690Z",
  "executiveSummary": "A reachable assertion vulnerability exists within the MP4Box component of the GPAC multimedia framework, specifically affecting versions up to f1219cde.\nThis vulnerability is triggered through the stbl_GetSampleInfos function in isomedia/stbl_read.c, leading to an abnormal program termination when processing maliciously crafted MP4 files.\nThe flaw poses a significant risk to system stability and availability, as it allows a local attacker to cause a denial-of-service (DoS) condition by executing an application crash.\nExploitation of this vulnerability requires local access to the system, though the availability of a public exploit increases the risk of successful exploitation by malicious actors.\nThe issue is addressed in version abi-16.23 via patch 49dee5cad329cfed310c1682703df7daa47df31a.\nUsers are advised to promptly upgrade to the patched version to mitigate potential service interruptions.",
  "technicalDetails": "The vulnerability resides in the stbl_GetSampleInfos function located within the isomedia/stbl_read.c file of the MP4Box component. The issue is characterized by a reachable assertion, which occurs when the software encounters an unexpected or invalid state while parsing the Sample Table Box (stbl) metadata structures within an MP4 file.\nAssertions in C-based software are typically used for development-time error checking. When an assertion fails during runtime in a production environment, the program invokes the abort() function, resulting in an immediate and unrecoverable termination of the process. In the context of MP4Box, this means the application fails to handle malformed input gracefully, allowing an attacker to force a process crash.\nThe attack flow requires the attacker to provide a specially crafted MP4 file to the MP4Box utility. When the application attempts to read the sample information using the vulnerable function, the internal parser identifies a logical inconsistency or data mismatch in the stbl structure. If the logic fails to validate the input parameters against the expected schema, the assertion condition is triggered.\nBecause the vulnerability is located in the file processing logic, it is exposed whenever MP4Box performs analysis, conversion, or inspection tasks on untrusted media files. An attacker with local access can initiate this attack by executing the MP4Box binary against a malicious file, effectively creating a denial-of-service vector. By forcing the termination of the media processing pipeline, an attacker can disrupt workflows relying on the GPAC framework.\nThe root cause is a failure in input sanitization and robust error handling within the media parsing logic. Instead of returning an error code or gracefully exiting the affected parsing routine, the code relies on an assertion that, if violated, terminates the entire process. This is particularly problematic for automated systems or services that process user-supplied media files.\nPost-exploitation impact is primarily limited to denial-of-service. There is no inherent indication of arbitrary code execution or privilege escalation; however, causing unexpected termination of security-sensitive media processing services may lead to secondary system instabilities. The existence of a public exploit necessitates immediate remediation to prevent widespread exploitation on systems where GPAC is utilized for automated media ingestion."
}