GPAC MP4Box CVE-2026-108539

Exploitation requires that MP4Box (the GPAC command-line tool) parse an attacker-crafted media/MP4 file that drives the vulnerable gf_fq_pop filter-queue path; the CVSS vector's UI:P confirms victim/operator interaction is needed, meaning the malicious file must be fed to the tool (manually opened or ingested by an automated transcoding/media pipeline). Limiting factors: there is no network-listening service involved despite the AV:N label, impact is limited to Low (crash or constrained memory corruption, not confirmed code execution), and exploitation depends on the target actually running a vulnerable GPAC build at or below 26.07.0 against untrusted input. Authentication is not required (PR:N), but delivery depends on getting the crafted file processed.

This is a low-priority issue despite the 'remote' framing. The vendor (VulDB) assigned a CVSS 4.0 base score of only 2.1 with vector AV:N/AC:L/AT:N/PR:N/UI:P and uniformly Low impacts (VC:L/VI:L/VA:L, no subsequent-system impact), which is consistent with a parser-level memory-corruption bug in a command-line media tool rather than a server-side remote-code-execution flaw. A public exploit exists (GitHub PoC.zip, E:P), so proof-of-concept weaponization effort is trivial, but there is NO CISA KEV listing and NO EPSS score supplied, so there is no evidence of real-world or widespread exploitation. The signals are therefore consistent rather than conflicting: easy-to-produce PoC plus low technical impact plus a non-network delivery reality. Note a key tension: the description and VulDB vector claim AV:N ('attack may be initiated remotely'), but MP4Box is a local file-processing CLI utility and UI:P indicates the victim must process attacker-supplied input - in practice this is file-borne (open/convert a malicious media file), not a network-listening service, so the 'remote' label overstates exposure. The vulnerability class (CWE-416 use-after-free) can in principle exceed a pure crash, but VulDB capped impacts at Low; code execution is not confirmed. Verify exploitability expectations against the public PoC rather than the AV:N label.

An attacker crafts a malformed MP4/media file that triggers the use-after-free in gf_fq_pop within GPAC's filter queue when MP4Box parses it, and distributes it (email attachment, download, or an automated media-processing pipeline). When a victim or an unattended service runs MP4Box over the file, the freed queue object is reused, crashing the tool or corrupting memory. A public proof-of-concept archive is already available on GitHub, lowering the barrier to reproduction.