CVE-2026-108538
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A security vulnerability has been detected in GPAC up to 26.07.0 affecting the function gf_mx_v of the file utils/os_thread.c of the MP4Box component. Manipulation leads to use after free, and the attack can be launched remotely. The exploit has been disclosed publicly and may be used; the vendor was contacted early but did not respond.
Risk Assessment
A remote attacker can exploit the use-after-free vulnerability to execute arbitrary code or crash the application, potentially leading to compromise of the system processing media files.
Recommendation
Restrict processing of untrusted media files with MP4Box until the vendor releases a fix, and monitor systems for unusual crashes.
Other vulnerabilities in GPAC
See all- CVE-2026-109827Medium
A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_ait of the file src/media_tools/ait.c of the component AIT Parser. Such manipulation leads to out-of-bounds write. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 6d2c21a1a688abb20d0111b608db3b6f44d348f4. Applying a patch is advised to resolve this issue.
- CVE-2026-92474Low
A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.
- CVE-2026-92472Low
A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2026-108539Medium
A vulnerability was detected in GPAC up to 26.07.0 affecting the function gf_fq_pop of the file filter_core/filter_queue.c of the MP4Box component. Manipulation results in use after free, and the attack may be initiated remotely. The exploit is now public and may be used; the vendor was contacted early but did not respond.
- CVE-2026-103227Medium
GPAC up to 26.07.0 has a buffer overflow vulnerability in the function gf_dash_resolve_url in src/media_tools/dash_client.c of the DASH Client component. The attack can be carried out remotely. Upgrading to version abi-16.26 resolves the issue.
Original NVD description (English source)
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS