Description

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T05:16:58.900Z",
  "pubdate": "2026-09-14T05:16:58.900Z",
  "executiveSummary": "A reachable assertion vulnerability exists within the gf_node_unregister function of the GPAC library's MP4Box component.\nThis vulnerability, identified in versions up to f1219cde, allows an attacker to trigger a crash through a manipulated input file.\nThe vulnerability is classified as a denial-of-service (DoS) condition, as the execution of the assertion results in the immediate termination of the application process.\nExploitation requires local access to the system, typically involving the processing of a maliciously crafted multimedia file by the affected software.\nWhile this does not provide remote code execution, it represents a significant availability risk for systems utilizing MP4Box for multimedia manipulation or parsing.\nUsers are strongly advised to update to version abi-16.23 to remediate the vulnerability, as the issue has been publicly disclosed and is susceptible to exploitation.",
  "technicalDetails": "The vulnerability resides in the scenegraph/base_scenegraph.c source file within the GPAC multimedia framework. Specifically, the flaw is located within the gf_node_unregister function, which is responsible for managing the lifecycle and registration of scene graph nodes during the parsing or manipulation of MP4 media structures.\nThe root cause is a logic error that results in an unsafe assumption about the state of the node registration process. When specific, malformed metadata or malformed structural definitions are provided in an MP4 file, the internal logic within gf_node_unregister triggers a reachable assertion. In C-based multimedia frameworks, assertions are often used as development-time checks to validate pointer states, memory integrity, or object hierarchy; when these conditions fail, the application invokes abort(), causing an abrupt process termination.\nExploitation requires the attacker to supply a crafted MP4 file to an application that utilizes the GPAC library to parse or process the media data. Because the exploit is local, an attacker must have the capability to induce the victim to process a malicious file. Upon parsing the specially crafted input, the component attempts to unregister an improperly initialized or reference-counted node, violating the condition set by the assertion. This forces the binary into a non-recoverable state, effectively performing a local denial-of-service attack.\nThe vulnerability is unique and distinct from CVE-2021-46237 and CVE-2021-46234, indicating a separate logical flaw within the node management subsystem. The lack of validation on the internal node state during the unregistration process allows the manipulated input to bypass standard sanity checks, directly reaching the fatal assertion. There is no evidence of memory corruption or arbitrary code execution; the impact is strictly confined to the premature termination of the application process, potentially disrupting critical media processing workflows.\nThe issue is fixed by the commit 49dee5cad329cfed310c1682703df7daa47df31a, which modifies the conditional checks within gf_node_unregister to handle the state transition gracefully instead of relying on an assertion. Systems running versions of GPAC prior to abi-16.23 are vulnerable to this DoS vector."
}