Use after free in GPAC MP4Box gf_fq_pop function
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
GPAC up to 26.07.0 is affected in the MP4Box component. A manipulation in the gf_fq_pop function of filter_core/filter_queue.c causes a use after free (CWE-416), where memory is accessed after it has been released. A remote attacker without privileges can trigger it, but user interaction is required. A public exploit exists.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for GPAC.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108539
- 2026-10-11 Alias added: GHSA-7m7x-953c-ffrf
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-108539 · CVE Program
- CVE-2026-108539 · NVD
- FIRST EPSS
- GHSA-7m7x-953c-ffrf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences