Description
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use after free leading to potential memory corruption or arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

A vulnerability exists in the gf_mx_v function of GPAC's MP4Box, located in os_thread.c. The flaw triggers a use‑after‑free condition that can corrupt memory and potentially allow an attacker to execute arbitrary code or cause a denial of service. This weakness is categorized under CWE‑119 and CWE‑416.

Affected Systems

GPAC versions up to 26.07.0 are affected. The issue impacts any deployment that uses the MP4Box component, regardless of operating system, because the vulnerable function is part of the core library.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The exploit is publicly disclosed and can be launched remotely, as the advisory states. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves remote interaction with MP4Box services that process supplied input, allowing an attacker to trigger the use‑after‑free.

Generated by OpenCVE AI on October 11, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to a release newer than 26.07.0 that contains the fix for the use‑after‑free flaw.
  • If an immediate upgrade is impossible, restrict or disable remote access to MP4Box functionality, ensuring only trusted users can invoke processing.
  • Enable operating‑system memory protection features such as Address Space Layout Randomization (ASLR) and stack guard canaries to make exploitation more difficult while a patch is pending.

Generated by OpenCVE AI on October 11, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 05:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title GPAC MP4Box os_thread.c gf_mx_v use after free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:18:43.795Z

Reserved: 2026-10-10T13:16:56.378Z

Link: CVE-2026-108538

cve-icon Vulnrichment

Updated: 2026-10-15T14:50:49.423Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T05:16:53.477

Modified: 2026-10-15T16:17:35.770

Link: CVE-2026-108538

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T06:45:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free