Use after free in GPAC MP4Box gf_mx_v function
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
GPAC up to 26.07.0 contains a use after free in the gf_mx_v function of utils/os_thread.c in the MP4Box component (CWE-416). A remote attacker with low privileges can trigger the memory corruption. A public exploit has been disclosed, and the vendor did not respond when contacted early about the disclosure.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GPAC.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108538
- 2026-10-11 Alias added: GHSA-6qp9-3j3r-w3r5
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-108538 · CVE Program
- CVE-2026-108538 · NVD
- FIRST EPSS
- GHSA-6qp9-3j3r-w3r5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences