Description

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T15:17:13.417Z",
  "pubdate": "2026-09-14T15:17:13.417Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified in the MP4Box component of the GPAC multimedia framework, specifically within the gf_node_unregister function located in scenegraph/base_scenegraph.c.\nThe vulnerability allows remote attackers to trigger memory corruption by manipulating specially crafted files, potentially leading to arbitrary code execution or a denial-of-service condition.\nThe flaw affects all GPAC versions up to f1219cde. Given that the exploit is now public, the risk to unpatched systems is elevated.\nSuccessful exploitation requires the victim to process a malicious input file. Once triggered, the UAF vulnerability compromises memory integrity, allowing an attacker to operate within the context of the GPAC process.\nOrganizations using MP4Box must prioritize upgrading to version abi-16.23, which incorporates the necessary patch identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24 to remediate the underlying memory management defect.",
  "technicalDetails": "The vulnerability resides within the scene graph management logic of the GPAC framework, specifically inside the gf_node_unregister function in scenegraph/base_scenegraph.c. This function is responsible for de-registering nodes within the internal scene graph representation used by MP4Box for multimedia composition.\nThe root cause is a Use-After-Free (UAF) error occurring during the lifecycle management of nodes. In the affected versions, the implementation of gf_node_unregister fails to properly nullify or manage references to a node object after it has been explicitly deallocated or removed from the scene graph structure. If the application continues to reference this dangling pointer, the memory may be reallocated for other objects by the system heap allocator.\nThe attack flow begins when an attacker provides a maliciously crafted multimedia file to the MP4Box component. As the parser processes the scene graph data, it triggers a sequence of operations that invokes gf_node_unregister prematurely or in an incorrect context relative to other references to the same memory object.\nOnce the memory has been freed, the dangling pointer persists within the heap management metadata or application logic. By controlling the contents of the memory that was freed, the attacker can influence the state of the heap. When the application subsequently attempts to perform operations on the dangling pointer—such as reading data, writing values, or executing callback functions associated with the node—it operates on memory that has already been relinquished or reclaimed.\nExploitation involves achieving control over the program flow through heap grooming or heap spraying techniques. By placing malicious data in the reclaimed memory, an attacker can overwrite critical control structures, such as function pointers or object vtables. When the application logic reaches the point of using the dangling pointer, it effectively executes the attacker's payload or redirects execution to arbitrary code locations.\nThis vulnerability is reachable remotely, as it is triggered through the processing of malformed input files by the MP4Box component, which is frequently utilized in network-exposed multimedia processing pipelines. The lack of proper reference counting or pointer validation within the scene graph handler facilitates this memory corruption, leading to a high potential for full system compromise or repeatable service crashes."
}