Description

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-15T08:17:06.617Z",
  "pubdate": "2026-09-15T08:17:06.617Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in GPAC up to commit f1219cde, specifically within the gf_node_get_name_and_id function in scenegraph/base_scenegraph.c.\nThe vulnerability allows for remote exploitation, potentially leading to arbitrary code execution, system crashes, or information disclosure.\nThis flaw occurs due to improper memory management during the handling of scenegraph nodes, where a reference to a freed memory object is accessed subsequently.\nGiven that exploit code has been publicly disclosed, the risk of active exploitation is significant.\nAffected systems running GPAC versions prior to abi-16.23 are vulnerable. Attackers can leverage this defect remotely, typically requiring the processing of maliciously crafted media files to trigger the vulnerability without specific authentication or elevated privileges.",
  "technicalDetails": "The vulnerability is a classic use-after-free (UAF) condition located within the gf_node_get_name_and_id function of the GPAC scenegraph engine (file: scenegraph/base_scenegraph.c).\nRoot Cause: The function performs operations on a node object that has already been deallocated or freed from memory. This indicates a failure in reference counting or lifetime management of the node objects during scene parsing or manipulation.\nExploitation Flow: An attacker can craft a malicious file, such as an MP4 or other media container supported by GPAC, containing specially manipulated node structures. When the library parses this file and invokes gf_node_get_name_and_id, the internal pointer to the node structure may point to memory that has been reclaimed or freed. By carefully controlling the heap layout—often through techniques such as heap spraying—an attacker can force the application to reuse the freed memory region for malicious objects.\nImpact: Successful exploitation can lead to arbitrary code execution under the context of the user or process running the GPAC library. Since the vulnerability is remotely triggerable, an attacker can compromise a system simply by convincing a user to open a crafted media file, or by directing a server-side process (such as a media transcoder or streaming service) to process the malicious input.\nTechnical Nuance: The vulnerability resides in the way the scenegraph interacts with the underlying memory management mechanisms. When gf_node_get_name_and_id is called on a node that has been improperly tracked or cleared by a previous operation, the pointer dereference results in undefined behavior. Because the exploit is already public, the barrier to entry for potential attackers is lowered, necessitating immediate remediation.\nThe vulnerability is fixed in version abi-16.23 via patch 49dee5cad329cfed310c1682703df7daa47df31a, which ensures that node references remain valid for the duration of the function call or implement stricter memory lifecycle management."
}