Description

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-15T07:16:34.237Z",
  "pubdate": "2026-09-15T07:16:34.237Z",
  "executiveSummary": "A critical use-after-free (UAF) vulnerability has been identified in the GPAC compositor component. The flaw resides within the gf_mo_get_od_id function located in compositor/media_object.c. This memory corruption issue allows remote attackers to trigger unintended memory access, potentially leading to arbitrary code execution, system crashes, or information disclosure. The vulnerability affects all versions of GPAC up to and including f1219cde. Given the existence of public exploit code, the risk of exploitation is significantly elevated. Attackers can leverage this vulnerability remotely without requiring prior authentication, necessitating immediate remediation to maintain system security posture and integrity.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) condition manifesting within the compositor's media object handling logic. Specifically, the function gf_mo_get_od_id, responsible for retrieving Object Descriptor (OD) identifiers, fails to properly manage the lifecycle of the media object pointer. When a media object is prematurely deallocated while remaining in use or accessible by the compositor, the subsequent reference to this memory address results in a use-after-free state.\nThe attack flow initiates when a remote attacker supplies a specially crafted media file or stream to the GPAC compositor. As the compositor parses the input, it triggers the vulnerable code path in compositor/media_object.c. The attacker manipulates the internal state of the compositor to force the deallocation of a memory block associated with an Object Descriptor. By maintaining a reference to this invalidated pointer, the attacker can influence the heap layout or trigger subsequent operations that use the dangling pointer.\nExploitation involves heap grooming or spraying to occupy the memory previously held by the deallocated media object with attacker-controlled data. When gf_mo_get_od_id or related routines later dereference this address, they act upon the attacker's malicious data rather than legitimate object structures. This can lead to arbitrary function pointer redirection, control flow hijacking, or out-of-bounds reads/writes depending on the surrounding context of the object usage.\nThe vulnerability affects GPAC versions up to f1219cde. The exploit is currently public, increasing the feasibility of remote code execution (RCE) attempts. Because the flaw occurs during the media parsing stage, the attack vector is inherently network-accessible via remote content delivery. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the GPAC process. Post-exploitation impact ranges from local system compromise to the installation of persistent malicious payloads, depending on the environment in which the GPAC compositor is deployed."
}