A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gfnodedeactivateex of the file src/scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.
A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
A vulnerability has been found in GPAC 26.07.0. Affected is the function gfsgdomeventbubble of the file src/scenegraph/domevents.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.
A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfieldcount of the file scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.
A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stblGetSampleInfos of the file isomedia/stblread.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.
A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.
A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmtparseelement of the file scenemanager/loaderxmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
A vulnerability was found in GPAC up to f1219cde. This affects the function gfsvgattributescopy of the file scenegraph/svgattributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrmltools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16.23 can resolve this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 is able to address this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfsgmfurldel of the file scenegraph/vrmltools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Upgrading to version abi-16.23 is sufficient to resolve this issue. The identifier of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is recommended to upgrade the affected component.
A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.
A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the component MP4Box. This manipulation of the argument naluoutbs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60473 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterinparentchain() function in GPAC's filter session core (filtercore/filterpid.c:2145) walks the filter parent chain to determine whether a given filter is an ancestor of another, and is called during PID initialization from gffilterpidinittask(). When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors, reused PIDs, and malformed PES headers that produce an abnormal PID chain state, the function is reached with a NULL or uninitialized parent filter pointer.
The function dereferences the parent pointer without validating it, attempting a READ at address 0x000000000008 (null+0x8 field offset), resulting in a segmentation fault and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 36gffilterinparentchainfiltercorefilterpidc2145
Asan-log: ==2015443==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f7ec2e52c65 bp 0x519000016d80 sp 0x7fffe9ee7390 T0) ==2015443==The signal is caused by a READ memory access. #0 0x7f7ec2e52c65 in gffilterinparentchain filtercore/filterpid.c:2145 #1 0x7f7ec2e7a796 in gffilterpidinittask filtercore/filterpid.c:4932 #2 0x7f7ec2ec3465 in gffsthreadproc filtercore/filtersession.c:2420
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36gffilterinparentchainfiltercorefilterpidc2145
References: https://github.com/gpac/gpac/issues/3285 https://www.cve.org/CVERecord?id=CVE-2025-60473 https://infosec.exchange/@sigdevel/116780471059317580
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60466 CWE: CWE-825 (Expired Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gffilterpidgetpacket() function in GPAC's filter session core (filtercore/filterpid.c:6827) retrieves the next available packet from a filter PID for processing by downstream filters such as the inspect filter. When MP4Box inspects a crafted MPEG-2 TS file with corrupted PMT descriptors and abnormal PCR discontinuities that drive the pipeline through PID deletion and re-enqueue paths, gffilterpiddel() frees the 336-byte PID instance at filtercore/filterpid.c:5933.
The inspect filter subsequently calls gffilterpidgetpacket() on the invalidated PID without checking whether the PID object has been released, performing a READ of 8 bytes at address 0x513000002dc0 (start of the freed allocation) and crashing the process (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 35gffilterpidgetpacketfiltercorefilterpidc6827
Asan-log: ==1994506==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000002dc0 at pc 0x7fdaa268b8b7 bp 0x7fff42a43b80 sp 0x7fff42a43b78 READ of size 8 at 0x513000002dc0 thread T0 #0 0x7fdaa268b8b6 in gffilterpidgetpacket filtercore/filterpid.c:6827 #1 0x7fdaa2906374 in inspectprocess filters/inspect.c:5218 #2 0x7fdaa26ef401 in gffilterprocesstask filtercore/filter.c:3180
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/35gffilterpidgetpacketfiltercorefilterpidc6827
References: https://github.com/gpac/gpac/issues/3284 https://www.cve.org/CVERecord?id=CVE-2025-60466 https://infosec.exchange/@sigdevel/116780402249845037
—— Best regards, Alexander A. Shvedov @sigdevel
Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60464 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>
Description: The gfseiloadfromstateinternal() function in GPAC's SEI loader (filters/seiload.c:225) processes Supplemental Enhancement Information payloads embedded in HEVC and VVC bitstreams transported over MPEG-2 TS. When MP4Box inspects a crafted TS file containing HEVC/VVC streams with malformed NAL units and corrupted PMT descriptors, the NALU demuxer naludmxconfigurepid() frees the codec state buffer at filters/reframenalu.c:370 during PID reconfiguration.
The function subsequently reads 1 byte from the freed 529,176-byte codec state region at address 0x7f7518dceb04 (529,156 bytes inside the freed allocation) without validating whether the buffer has been released, resulting in a heap-use-after-free and process crash (Denial of Service).
Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.
Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 32filtersseiloadc225ingfseiloadfromstateinternal
Asan-log: ==33468==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f7518dceb04 at pc 0x7f751b19dbf5 bp 0x7ffc77f69500 sp 0x7ffc77f694f8 READ of size 1 at 0x7f7518dceb04 thread T0 #0 0x7f751b19dbf4 in gfseiloadfromstateinternal filters/seiload.c:225 #1 0x7f751b19dbf4 in gfseiloadfromstate filters/seiload.c:265 #2 0x7f751b0ffd02 in naludmxfinalizeauflags filters/reframenalu.c:2360
PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/32/32filtersseiloadc225ingfseiloadfromstateinternal
References: https://github.com/gpac/gpac/issues/3278 https://www.cve.org/CVERecord?id=CVE-2025-60464 https://infosec.exchange/@sigdevel/116778370895014131
—— Best regards, Alexander A. Shvedov @sigdevel
A use-after-free in the gffilterpidinstswap function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.
A use-after-free in the gffilterpidreconfiguretaskdiscard function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.