Bug on 2ourc3

CVE-2026-TBD - Use-after-free write in GPAC HTTP input filter error path

Tue, 06 Oct 2026 10:00:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: in_http.c (HTTP input filter)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV; only HEAD is supported per GPAC policy)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3747 closed 2026-07-23
Severity: Critical (9.2): CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Credit: Salim Largo (2ourc3)

Description

A heap use-after-free write exists in GPAC’s HTTP input filter, in httpin_notify_error(). When the filter’s error-notification path runs during session setup, gf_filter_setup_failure() can tear down the filter (freeing its context), but the function continues to write to that freed context afterward.

CVE-2026-TBD - Use-after-free write in GPAC ISOBMFF reader (fragmented MP4)

Tue, 06 Oct 2026 10:01:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: isoffin_read.c (ISOBMFF / MP4 reader filter)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3748 closed 2026-07-23
Severity: High (8.5): CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Credit: Salim Largo (2ourc3)

Description

A heap use-after-free write exists in GPAC’s ISOBMFF (MP4/MOV) reader, in isoffin_push_buffer(). While demuxing a crafted fragmented MP4/MOV file, an error branch tears down the reader filter and then keeps writing to the now-freed reader context.

CVE-2026-TBD - Use-after-free write in GPAC ISOBMFF reader (moof after mdat)

Tue, 06 Oct 2026 10:02:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: isoffin_read.c (ISOBMFF / MP4 reader filter)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3749 closed 2026-07-23
Severity: High (8.5): CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
Credit: Salim Largo (2ourc3)

Description

A second heap use-after-free write exists in the same function as the sibling bug at isoffin_read.c:1301, this time in the “unsupported moof-after-mdat” error branch of GPAC’s ISOBMFF reader: a non-fragmented file where a moof box unexpectedly appears after an mdat box, with no file cache available.

CVE-2026-TBD - Use-after-free write in GPAC AV1 reframer (OBU parse error)

Tue, 06 Oct 2026 10:03:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: reframe_av1.c (AV1 reframer / demuxer filter)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3744 closed 2026-07-23
Severity: High (7.8 / CVSS 3.1, 8.5 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credit: Salim Largo (2ourc3)

Description

A heap use-after-free write exists in GPAC’s AV1 reframer, in av1dmx_check_format(). When OBU (Open Bitstream Unit) parsing fails on a crafted AV1 stream, the filter is torn down via gf_filter_setup_failure(), which can free the demuxer’s context, but the function then writes to that freed context on its way out.

CVE-2026-TBD - Use-after-free write in GPAC AV1 reframer (missing temporal delimiter)

Tue, 06 Oct 2026 10:04:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: reframe_av1.c (AV1 reframer / demuxer filter)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3745 closed 2026-07-23
Severity: High (7.8 / CVSS 3.1, 8.5 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credit: Salim Largo (2ourc3)

Description

A second heap use-after-free write exists in the same function as the sibling bug at reframe_av1.c:303, this time reached when a stream has no timescale and never carries a temporal delimiter OBU.

CVE-2026-TBD - Use-after-free in GPAC filter-session process task

Tue, 06 Oct 2026 10:05:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: filter.c (filter-session core / scheduler)
Vulnerability Type: Use-after-free (write)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3746 closed 2026-07-23
Severity: High (7.8 / CVSS 3.1, 8.5 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credit: Salim Largo (2ourc3)

Description

A heap use-after-free write exists in the core of GPAC’s filter-session scheduler, in gf_filter_process_task(). If a filter’s own process() callback causes the filter itself to be torn down (e.g. by calling gf_filter_setup_failure() internally), the dispatcher that invoked the callback keeps writing to the now-freed GF_Filter structure once the callback returns.

CVE-2026-TBD - Use-after-free read in GPAC filter-session PID init task

Tue, 06 Oct 2026 10:06:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: filter_pid.c (filter-session core / PID resolution)
Vulnerability Type: Use-after-free (8-byte pointer read)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3743 closed 2026-07-23
Severity: Medium (5.5 / CVSS 3.1, 6.9 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Credit: Salim Largo (2ourc3)

Description

A heap use-after-free read exists in GPAC’s filter-session core, in gf_filter_pid_init_task(). While resolving the filter chain for a newly-created PID, the task function can end up dereferencing a PID (or its owning filter) that was freed as part of that same resolution process.

CVE-2026-TBD - Heap buffer overflow in GPAC AC-3 bitstream reader

Tue, 06 Oct 2026 10:07:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: bitstream.c (core bitstream reader), reached via the AC-3 parser
Vulnerability Type: Heap buffer overflow (1-byte out-of-bounds read)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3740 closed 2026-07-23
Severity: Medium (5.5 / CVSS 3.1, 5.1 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Credit: Salim Largo (2ourc3)

Description

A heap-buffer-overflow (1-byte out-of-bounds read) exists in GPAC’s core bitstream reader, reachable from the AC-3 audio parser: a bitstream declared larger than its backing allocation reads one byte past the end of that allocation.

CVE-2026-TBD - Heap buffer overflow in GPAC BT/XMT scene loader probe

Tue, 06 Oct 2026 10:08:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: load_bt_xmt.c (BT/XMT scene loader format probe)
Vulnerability Type: Heap buffer overflow (1-byte out-of-bounds read)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3741 closed 2026-07-23
Severity: Medium (5.5 / CVSS 3.1, 5.1 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Credit: Salim Largo (2ourc3)

Description

A heap-buffer-overflow (1-byte out-of-bounds read) exists in GPAC’s BT/XMT scene-loader format probe: strncmp reads past the end of the probe buffer when checking for a <!DOCTYPE marker.

CVE-2026-TBD - Heap buffer overflow in GPAC H.264/H.265 NALU reframer probe

Tue, 06 Oct 2026 10:09:00 +0100

Summary

CVE: CVE-2026-TBD (CVE ID requested via MITRE, batch submission 2026-07-19)
Component: reframe_nalu.c (H.264/H.265 NALU reframer format probe)
Vulnerability Type: Heap buffer overflow (1-byte out-of-bounds read)
Vendor: GPAC
Product: GPAC (libgpac / MP4Box / gpac)
Affected Versions: master branch, commit 9bfcd13401cd1e52f966d03670c433d25952472c (26.03-DEV)
Fix Status: Fixed upstream: commit 03e5b1c (2026-07-22); issue #3742 closed 2026-07-23
Severity: Medium (5.5 / CVSS 3.1, 5.1 / CVSS 4.0): CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Credit: Salim Largo (2ourc3)

Description

A heap-buffer-overflow (1-byte out-of-bounds read) exists in GPAC’s H.264/H.265 NALU reframer format probe: it reads data[1] without first checking that a second byte actually remains in the probe buffer.