Description

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T16:17:41.290Z",
  "pubdate": "2026-09-14T16:17:41.290Z",
  "executiveSummary": "A use-after-free vulnerability has been identified in the GPAC MP4Box component, specifically within the gf_sg_script_load function of scenegraph/vrml_tools.c.\nThis flaw allows a remote attacker to trigger a memory corruption state, potentially leading to arbitrary code execution or a denial-of-service condition.\nThe vulnerability affects GPAC versions up to f1219cde. Given that the exploit code has been made public, the risk of exploitation is elevated for systems processing untrusted media files.\nSuccessful exploitation requires the victim to interact with a specially crafted file, enabling remote adversaries to leverage the use-after-free condition to manipulate the application's heap state.\nUsers are strongly advised to upgrade to version abi-16.23 or apply the vendor-provided patch to mitigate this high-severity security risk.",
  "technicalDetails": "The vulnerability resides in the scenegraph/vrml_tools.c file within the MP4Box component of GPAC. Specifically, the gf_sg_script_load function improperly manages the lifecycle of memory objects associated with VRML script loading.\nA use-after-free condition occurs when the application attempts to access or reference memory that has already been deallocated. In the context of gf_sg_script_load, the flaw is triggered during the parsing or execution phase of VRML scripts within a media container.\nThe attack flow begins when an attacker provides a maliciously crafted MP4 or related media file containing a specifically structured VRML script. When the MP4Box tool invokes gf_sg_script_load to process the script, the internal pointer management logic fails to reconcile the object state correctly, leading to a dangling pointer.\nWhen the program attempts to perform operations on the deallocated memory location—or subsequently reallocates that memory for a different object—the attacker can leverage this window of inconsistency to manipulate heap control structures or inject malicious payloads.\nBecause the exploit can be initiated remotely through standard media processing workflows, it poses a significant threat to systems configured to automatically parse or preview files using the vulnerable version of GPAC.\nThe technical root cause is an inadequate synchronization between the object deallocation lifecycle and the reference counting or pointer validation mechanisms within the scenegraph handling routines. By triggering specific code paths that result in the premature freeing of internal script structures, an attacker forces the application into an unstable state.\nExploitation of this use-after-free vulnerability can lead to arbitrary code execution if the attacker successfully controls the contents of the heap at the time of the dangling pointer dereference. This allows the redirection of execution flow, enabling the execution of arbitrary instructions with the privileges of the GPAC process.\nThe vulnerability affects all versions of GPAC up to commit f1219cde. Remediation involves applying the official patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24, which ensures that pointers are correctly invalidated or managed during the script loading lifecycle."
}