Description

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-09-14T06:16:58.300Z",
  "pubdate": "2026-09-14T06:16:58.300Z",
  "executiveSummary": "A reachable assertion vulnerability exists in the MP4Box component of GPAC up to commit f1219cde. The vulnerability resides within the lsr_exec_command_list function located in laser/lsr_dec.c.\nThis flaw allows an attacker to trigger an abnormal program termination via a specifically crafted input file, leading to a Denial of Service (DoS) condition.\nThe vulnerability requires local access to the system to exploit, typically involving a user opening a malicious file with an affected version of MP4Box.\nGiven that the exploit has been disclosed publicly, the risk of exploitation is elevated. Impact is limited to service availability, as the assertion failure forces the application to terminate unexpectedly.\nGPAC users are strongly advised to upgrade to version abi-16.23 to remediate this issue.",
  "technicalDetails": "The vulnerability is located in the LASeR (Lightweight Application Scene Representation) decoding logic of the MP4Box component, specifically within the lsr_exec_command_list function defined in laser/lsr_dec.c. The root cause is an improper validation of input data during the command list execution phase, which triggers a programmatic assertion failure.\nIn the GPAC source code, assertions are used as debugging mechanisms to verify that specific assumptions about the program state hold true. When the input processed by lsr_exec_command_list violates these internal logic constraints, the runtime environment triggers an abort signal, causing the entire process to crash.\nThe attack flow begins with the delivery of a malformed or maliciously crafted media file containing a specifically manipulated LASeR command stream. When MP4Box attempts to parse and execute this command list using the vulnerable function, it encounters an unexpected state or invalid data structure. Because the code lacks robust error handling for this specific condition, the assertion failure is reached, resulting in immediate process termination.\nExploitation requires the attacker to have local access, as they must induce the target user or system to process the malicious file. Since the function lsr_exec_command_list is responsible for processing complex scene description data, an attacker can leverage this to crash the application, effectively disrupting any services or automated workflows relying on GPAC for media processing.\nThe scope of the impact is localized to a Denial of Service. There is no evidence suggesting that this vulnerability allows for remote code execution or privilege escalation; however, it reliably compromises the availability of the affected component. The patch, identified by commit hash afca1f1181668d85941d51ed1adf647807d5d975, likely introduces additional boundary checking or conditional logic to handle the anomalous input gracefully, thereby preventing the assertion from being triggered.\nThe affected versions include all GPAC builds up to commit f1219cde. Users are encouraged to verify their current version string and ensure they are running at least abi-16.23."
}