Description

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-15T08:17:07.000Z",
  "pubdate": "2026-09-15T08:17:07.000Z",
  "executiveSummary": "A memory corruption vulnerability exists within the GPAC multimedia framework, specifically impacting the Node Insertion component.\nThe vulnerability is located in the function gf_node_list_insert_child within scenegraph/base_scenegraph.c.\nGPAC versions up to f1219cde are confirmed to be vulnerable to this issue.\nThe vulnerability can be exploited remotely by an unauthenticated attacker, potentially leading to arbitrary code execution or denial-of-service conditions through system instability.\nGiven that exploit code is publicly available, the risk to affected systems is high, necessitating immediate remediation.\nImpacted systems include any application utilizing the GPAC framework for scenegraph processing, particularly those exposed to untrusted multimedia content.",
  "technicalDetails": "The vulnerability originates from unsafe memory management practices within the gf_node_list_insert_child function, situated in scenegraph/base_scenegraph.c. This function is responsible for managing the hierarchy of nodes within the GPAC scenegraph engine. The root cause pertains to improper handling of child node pointers or insufficient boundary checks during the insertion process, which facilitates a memory corruption scenario.\nThe attack vector involves the delivery of a specially crafted multimedia file or stream to an application leveraging the GPAC library. As the parser processes the scenegraph structures, the vulnerable gf_node_list_insert_child function is invoked. An attacker can manipulate the node structure inputs to trigger an out-of-bounds write or a use-after-free condition during the insertion phase. By controlling the data structures being passed to the function, the attacker may overwrite adjacent memory blocks in the heap, leading to control flow hijacking.\nBecause the manipulation occurs during node insertion, an attacker can precisely craft the malformed content to corrupt function pointers or object vtables. Once the corrupted pointer is dereferenced during normal program execution, the execution flow is redirected to an attacker-controlled memory address, facilitating arbitrary code execution under the context of the GPAC-reliant application process.\nThis vulnerability is remotely exploitable as it does not require prior authentication or privileged access. The exploit is triggered simply by the application parsing malicious input data, which is a common activity for media players and streaming clients. The complexity of the exploit is reduced due to the public availability of proof-of-concept code, increasing the likelihood of active exploitation. Post-exploitation, an attacker can achieve code execution, potentially bypassing platform security boundaries depending on the privileges of the hosting process."
}