EUVD-2026-96731
GHSA-6qp9-3j3r-w3r5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious media file
-
ExploitDeliver file to MP4Box user/pipeline
-
ExecutionTrigger use-after-free during parsing
-
ImpactCrash or corrupt process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to invoke MP4Box (the GPAC packaging tool) on an attacker-controlled or malformed media file; the use-after-free is reached through the file-parsing code path rather than any listening network service. Limiting factors: there is effectively a user-interaction/processing requirement (someone or some pipeline must run MP4Box on the hostile input), the product is a local command-line/library component rather than a remotely exposed daemon, and the affected scope is GPAC builds up through 26.07.0. The input's claim of remote, low-privilege exploitation is not supported by the product's architecture and should be verified with the maintainers. |
| Impact | This is a low-priority issue despite the 'launched remotely' language. The vendor-supplied CVSS 4.0 base score is only 2.1, with all impacts rated Low (VC:L/VI:L/VA:L) and no subsequent-system impact - consistent with a use-after-free (CWE-416) in a media-parsing utility that most realistically causes a crash rather than reliable code execution. The input signals conflict: the CVSS vector claims AV:N (network) and PR:L, yet GPAC/MP4Box is a command-line multimedia packager that operates on files, so real-world exploitation almost certainly requires a victim to run MP4Box against an attacker-supplied file - closer to local/file-borne exploitation with user interaction than true unauthenticated network attack. The PR:L (privilege required) assignment is also dubious for a tool that simply processes a file and is a known artifact of the automated VulDB scoring. Publicly available exploit code exists (POC.zip), which modestly raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. Net: treat as a low-severity robustness/DoS bug to patch in due course, not an urgent emergency. VERIFY the attack vector with the maintainers - CVSS indicates network vector but the product is a local file processor, implying the AV:N is overstated. |
| Exploit ScenarioDerived | An attacker crafts a malformed MP4/media file and delivers it to a victim who processes it with MP4Box (e.g., in an automated media-transcoding pipeline or manually on the command line). Parsing triggers a use-after-free in the referenced GPAC code path, most likely crashing the process (denial of service) with a lower likelihood of memory corruption leading to further impact. A public proof-of-concept (PoC.zip) is available, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Use-after-free in GPAC's MP4Box media packaging tool (all builds through 26.07.0) can be triggered when the utility parses a malformed or attacker-supplied media file, corrupting memory in the affected process. The fault lives in the gf_mx_v() helper in utils/os_thread.c and is reached through the file-parsing path, not through any listening network service, so exploitation requires someone or an automated pipeline to run MP4Box on the hostile input. Publicly available exploit code exists (a PoC archive is linked from the advisory), the vendor was contacted early but did not respond, and there is no indication of active exploitation (no CISA KEV listing); impact is limited to availability of the processing process rather than confidentiality or integrity of the host.
RemediationAI
No vendor-released patch identified at time of analysis - the report states the vendor was contacted early and did not respond, and no fixed GPAC version is published, so treat all builds through 26.07.0 as vulnerable. The most effective compensating control is to avoid feeding untrusted or unverified media files to MP4Box: restrict processing to files from trusted sources and quarantine/scan uploads before any automated transcoding or packaging step, at the cost of breaking untrusted-input workflows. Where untrusted input must be handled, run MP4Box inside a sandbox with a minimal filesystem view, dropped privileges, no network access, and seccomp/AppArmor or container confinement (for example bubblewrap or a read-only Docker image) so that a memory-corruption crash cannot pivot to the host; this adds operational overhead and may break features requiring file writes or codec access. Running MP4Box as an unprivileged, dedicated service account limits blast radius but does not prevent the crash itself, and building GPAC with AddressSanitizer or hardened malloc can turn the use-after-free into a fast, detectable abort rather than silent corruption - useful for pipeline triage, at a substantial performance cost. Monitor the upstream GPAC repository and the VulDB advisory (https://vuldb.com/vuln/416193) for a maintainer fix and apply it as soon as a patched release is tagged; until then, consider excluding MP4Box from security-sensitive automated ingestion paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GPAC is a widely used open-source multimedia framework whose MP4Box command-line tool handles packaging, inspection and conversion of MP4, DASH, HLS and related container formats; the same code is also consumed as the libgpac library by third-party applications. The reported flaw is CWE-416 (Use After Free) in the function gf_mx_v() of utils/os_thread.c, which is GPAC's internal mutex/threading primitive layer. In practical terms this means a threading or mutex object (or a structure containing it) is released while still referenced by parser-side code, so subsequent access reads or writes freed heap memory - the classic recipe for crashes, and potentially for controlled memory corruption depending on heap layout. VulDB classified the issue under CVSS 4.0 as AV:N/PR:L/E:P (score 2.1, with proof-of-concept exploit code), whereas the independent assessment maps it to CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L: local attack vector, no privileges required, but user interaction (invoking MP4Box on the hostile file) is needed, scope unchanged, and only availability is affected. The discrepancy stems from the product's architecture - MP4Box is a local CLI/library component, not a remotely exposed daemon - so the 'launched remotely' wording in the source description should be treated as an unverified claim and confirmed with the maintainers. Affected CPE data is generic (cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:*), i.e. no version bounds are published upstream, so all GPAC releases up to and including 26.07.0 must be assumed affected.
Know when Gpac gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MP4Box processes local files so AV:L and UI:R (victim must run it on the crafted file); a use-after-free in a CLI parser most realistically yields a crash, so A:L with C:N/I:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Exploit-DB