CVE-2026-108539: GPAC MP4Box filter_queue.c gf_fq_pop use after free
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gffqpop of the file filtercore/filterqueue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is remotely reachable and requires no privileges, but it requires user interaction. The available data does not specify what form that interaction takes.
Which systems should be prioritized for triage?
Prioritize systems running GPAC MP4Box versions up to 26.07.0, particularly where MP4Box processes content that may be influenced by remote or untrusted parties. A public exploit is reported to exist.
Is a vendor fix or workaround available?
The provided information does not identify a fixed version, workaround, or vendor response. The vendor reportedly did not respond to early disclosure contact.