Description

A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-09-14T05:16:59.067Z",
  "pubdate": "2026-09-14T05:16:59.067Z",
  "executiveSummary": "A reachable assertion vulnerability exists within the MP4Box component of GPAC, specifically within the gf_node_get_field_count function located in scenegraph/base_scenegraph.c.\nThis vulnerability, present in versions up to f1219cde, allows a local attacker to trigger an abnormal process termination by supplying a specially crafted input.\nThe flaw manifests as an assertion failure, which interrupts the execution flow of the application. Given that exploitation leads to a denial-of-service condition through application crash, the integrity and availability of the affected system are directly impacted.\nThe vulnerability is accessible to local users, and exploit code has been publicly disclosed, increasing the risk of practical exploitation. GPAC users are advised to upgrade to version abi-16.23 to resolve this security issue.",
  "technicalDetails": "The vulnerability resides in the gf_node_get_field_count function within the scenegraph/base_scenegraph.c file of the GPAC MP4Box component.\nThe root cause is an insecure assertion triggered during the processing of malformed data structures within the scene graph. When the function attempts to retrieve a field count from a node structure that does not conform to expected internal constraints or memory layout, it triggers a logical condition check via an assertion macro.\nIn the context of C-based applications, the use of assertions (such as those provided by the assert.h header) is intended for debugging purposes to enforce invariants. When these assertions fail in a production environment, the runtime library terminates the application execution immediately.\nThe attack flow begins when an attacker provides a crafted file or data stream to MP4Box. As MP4Box processes the input, the internal scene graph parser traverses nodes, eventually invoking gf_node_get_field_count. If the input is specifically structured to violate the assumed internal state of the scene graph—such as providing unexpected node types or truncated attributes—the function encounters a state it deems impossible, triggering the assertion.\nBecause this operation can be initiated locally, an attacker does not require elevated privileges to execute the malicious input against a local instance of the application. The exploitation does not result in arbitrary code execution; rather, it achieves a reliable denial-of-service (DoS) state by crashing the process.\nThe vulnerability is present in all versions up to commit f1219cde. The patch identified by hash 49dee5cad329cfed310c1682703df7daa47df31a introduces necessary input validation checks within the scene graph logic, ensuring that the function handles unexpected or corrupted node field requests gracefully instead of terminating the execution environment.\nPost-exploitation, the primary impact is the loss of availability for the MP4Box service. In environments where MP4Box is used as a backend processing engine for automated media pipelines, this vulnerability could be leveraged to disrupt media ingestion or transcoding services, potentially leading to service degradation or system instability."
}