Description
A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
Published: 2026-07-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A double‑free flaw exists in the gf_isom_nalu_sample_rewrite function of the GPAC MP4Box utility. When the nalu_out_bs argument is processed, the routine frees the same memory block twice, corrupting heap metadata and potentially causing a program crash or undefined behavior. The weakness is categorized as CWE‑119 and CWE‑415.

Affected Systems

All GPAC builds that include the MP4Box component up to and including the 2.5‑DEV release series are affected. This includes any distribution of GPAC that deploys MP4Box. Users running these versions on any operating system are at risk when they invoke MP4Box with media files that may originate from external sources.

Risk and Exploitability

The CVSS score of 4.8 indicates a low overall severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation in the field. The vulnerability requires local execution of MP4Box; the likely attack vector is local execution of the MP4Box binary with a crafted media file, and no remote or network-based trigger is documented. The vulnerability is not listed in the CISA KEV catalog and is currently demonstrated only by a local crash proof‑of‑concept.

Generated by OpenCVE AI on August 1, 2026 at 18:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch commit f29f955f2a3b5e8e507caad3e52319f961bf37bf to the GPAC source or use an updated binary from the vendor to eliminate the double‑free flaw.
  • Restrict the privileges under which MP4Box operates; run it with the least privilege and avoid elevated rights when processing media from untrusted sources.
  • If a patch cannot be applied immediately, avoid running the vulnerable MP4Box binary on systems that handle untrusted media, or temporarily disable MP4Box or route such media through a safer conversion tool.

Generated by OpenCVE AI on August 1, 2026 at 18:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 12:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box. This manipulation of the argument nalu_out_bs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.
Title GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-415
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T18:50:01.768Z

Reserved: 2026-07-04T05:16:18.510Z

Link: CVE-2025-15667

cve-icon Vulnrichment

Updated: 2026-07-06T18:49:57.612Z

cve-icon NVD

Status : Deferred

Published: 2026-07-06T12:16:38.457

Modified: 2026-07-06T19:16:53.743

Link: CVE-2025-15667

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T18:45:03Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-415

    Double Free