CVE-2026-92474: GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free
A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.24 mitigates this issue. The patch is identified as e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC 26.08-DEV (Proto Link Handler)to a version that resolves this vulnerability.Fixed in abi-16.24Patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7 - Compensating control
Because the attack requires a local approach and the exploit is publicly released, restrict local access to systems running the Proto Link Handler (e.g., limit who can run code or access the affected process) until the upgrade is completed.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Exploitation requires local access and low privileges. Systems running the affected GPAC Proto Link Handler component are the relevant exposure scope.
Is exploit code available?
Yes. The exploit has been released publicly and may be used in attacks.
What should be done to remediate the issue?
Upgrade the affected component to version abi-16.24 or later. The remediation patch is e34f4ba349d55cd1849f0bcf4cf46552732e2db7.