Description

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-14T16:17:41.093Z",
  "pubdate": "2026-09-14T16:17:41.093Z",
  "executiveSummary": "A critical Use-After-Free (UAF) vulnerability has been identified in the MP4Box component of the GPAC multimedia framework, specifically within the gf_node_get_name function in scenegraph/base_scenegraph.c.\nThe vulnerability affects all GPAC versions up to f1219cde, presenting a significant security risk to systems processing untrusted multimedia content.\nThe flaw stems from improper memory management within the scenegraph processing logic, which can lead to memory corruption or arbitrary code execution.\nAn attacker can remotely trigger this vulnerability by providing a specifically crafted media file to a target system utilizing the affected GPAC build.\nGiven that proof-of-concept exploit code has been publicly disclosed, the exploitability of this flaw is high.\nSuccessful exploitation allows for memory corruption scenarios that may be leveraged for system compromise or service disruption.\nUsers are strongly advised to upgrade to version abi-16.23, which incorporates the necessary security patches.",
  "technicalDetails": "The vulnerability resides in the gf_node_get_name function located within scenegraph/base_scenegraph.c. This function is responsible for retrieving the identifier or name associated with a node within the GPAC scenegraph hierarchy.\nThe root cause is a Use-After-Free condition occurring during the lifecycle management of node objects. In the affected versions, the application fails to correctly track the reference count or the lifetime of a node pointer, allowing it to be freed while subsequent operations still attempt to access the memory location.\nExploitation is typically achieved through the parsing of a malicious MP4 file. The attacker embeds malformed scenegraph structures within the bitstream, designed to trigger the lifecycle management error within MP4Box. When the parser attempts to retrieve a node name during the rendering or processing of these structures, the application inadvertently interacts with a dangling pointer.\nThe attack flow follows a structured path: First, the attacker delivers a specially crafted file to the victim. Second, the GPAC parser initializes the scenegraph and begins node traversal. Third, the vulnerability is triggered when the application accesses a memory segment that has already been deallocated but not cleared in the heap, leading to a UAF state.\nBecause this vulnerability occurs during the processing of media data, it is remotely exploitable without requiring authentication, provided the target application processes the malicious file. The reliance on heap memory management means that an attacker who can influence heap layout or perform heap spraying may achieve reliable code execution.\nThe memory corruption resulting from the UAF can be used to overwrite adjacent objects or function pointers in the heap. By carefully manipulating the state of the heap before the free and subsequent access, an attacker can redirect the execution flow of the GPAC process to attacker-controlled code or payloads.\nThe affected component, MP4Box, is a widely used multimedia tool; therefore, the impact extends to any software or service that integrates GPAC for processing, transcoding, or inspecting multimedia data. Publicly available exploit code exacerbates the threat level, as it lowers the barrier to entry for potential attackers seeking to weaponize this memory safety failure.\nThe vulnerability is addressed by patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24, which ensures that node lifetimes are properly tracked and references are invalidated securely, preventing unauthorized access to deallocated memory blocks."
}