Description

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T06:16:58.677Z",
  "pubdate": "2026-09-14T06:16:58.677Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability exists within the GPAC multimedia framework, specifically affecting the MP4Box component.\nThe flaw is located in the gf_node_changed_internal function within scenegraph/base_scenegraph.c. It impacts all GPAC versions up to f1219cde.\nThis vulnerability poses a significant security risk, as it allows for potential remote code execution or application crashes by manipulating memory management during scene graph processing.\nSuccessful exploitation enables an attacker to influence program flow through dangling pointer references, potentially leading to unauthorized memory access or arbitrary code execution.\nThe vulnerability is remotely exploitable, making it a high-priority risk for systems processing untrusted multimedia files. Publicly disclosed exploit code exists, increasing the likelihood of active exploitation.\nImmediate remediation is required by upgrading to version abi-16.23 or applying the vendor-provided patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24.",
  "technicalDetails": "The vulnerability is identified as a Use-After-Free (UAF) condition within the GPAC scenegraph handling logic. The root cause lies in the improper management of memory lifetimes for nodes processed by the gf_node_changed_internal function within scenegraph/base_scenegraph.c.\nIn the context of the MP4Box component, the scene graph architecture maintains complex pointer references to node objects. A UAF occurs when the application attempts to access, modify, or reference a memory address that has already been deallocated by the internal memory manager.\nThe attack flow typically begins with an attacker crafting a malicious multimedia file designed to trigger specific state changes within the scene graph. When MP4Box parses the input, the gf_node_changed_internal function is invoked to handle updates to the scene tree. Due to inadequate synchronization or reference counting logic, the engine may free a node while a pointer to that node remains active and is subsequently accessed.\nExploitation involves heap grooming techniques. By carefully manipulating the memory layout prior to triggering the UAF, an attacker can ensure that the freed memory block is reallocated with malicious data. When the vulnerable function subsequently accesses the dangling pointer, it effectively operates on attacker-controlled data instead of the expected object structure.\nThe vulnerability does not strictly require local access, as remote exploitation is possible when an application processes a maliciously crafted media file provided via network protocols or remote web resources. Because the scene graph components are core to the rendering and processing of MP4/ISO base media file format content, the attack surface is exposed through standard media parsing workflows.\nThe post-exploitation impact is severe, potentially resulting in arbitrary code execution under the security context of the process running MP4Box. If code execution is not achieved, the inconsistency in memory state often results in a controlled or uncontrolled crash, leading to a Denial-of-Service (DoS) condition.\nThe affected versions include the GPAC repository up to commit f1219cde. Protection is achieved via patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24, which ensures proper reference tracking and lifecycle management of scene graph nodes, effectively preventing access to invalid memory regions during the node modification sequence."
}