Description
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability originates in the GPAC MP4Box component, specifically within the gf_fq_pop routine of filter_core/filter_queue.c. A use‑after‑free flaw can be triggered by manipulating input, potentially allowing an attacker to execute arbitrary code or crash the application. The weakness is identified by CWE‑119 (Buffer or Window Overread/Write) and CWE‑416 (Use After Free).

Affected Systems

GPAC, the multimedia framework, is impacted in all releases up to and including version 26.07.0. The flaw resides in the MP4Box tool, which may be used by clients processing MP4 or related media files.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exploit code is publicly available and an attacker can launch the attack from a remote position. The risk is therefore contingent on the exposure of the affected component to untrusted data, but the lack of a formal patch or advisories means administrators must act quickly to mitigate potential exploitation.

Generated by OpenCVE AI on October 11, 2026 at 06:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Acquire and install the latest GPAC release that addresses the use‑after‑free bug, if available.
  • If an update cannot be applied immediately, disable or segregate the MP4Box component from processing untrusted media files to limit exposure.
  • Enable logging and monitoring for abnormal memory access or crash events to detect exploitation attempts early.

Generated by OpenCVE AI on October 11, 2026 at 06:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 09:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 11 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title GPAC MP4Box filter_queue.c gf_fq_pop use after free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T19:57:36.916Z

Reserved: 2026-10-10T13:17:00.260Z

Link: CVE-2026-108539

cve-icon Vulnrichment

Updated: 2026-10-13T19:57:31.431Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T05:16:53.680

Modified: 2026-10-13T20:17:20.140

Link: CVE-2026-108539

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T06:45:17Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free