CVE-2026-108538— GPAC MP4Box os_thread.c gf_mx_v use after free
Quick assessment
Affected
n/a GPAC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已发现 GPAC 最高版本 26.07.0 中存在安全漏洞。受影响的组件为 MP4Box，具体涉及文件 utils/os_thread.c 中的函数 gf_mx_v。该漏洞可导致“释放后使用”（use-after-free）错误。攻击者可远程发起攻击。该漏洞的利用代码已公开披露，可能被滥用。供应商虽在漏洞披露初期已收到通知，但至今未作任何回应。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108538
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GPAC MP4Box os_thread.c gf_mx_v use after free
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the file utils/os_thread.c of the component MP4Box. Such manipulation leads to use after free. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | GPAC | 26.07 |
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-108538
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108538
请登录查看更多情报信息。
Other References for CVE-2026-108538 (1)
Same Patch Batch · n/a · 2026-10-11 · 4 CVEs total
| CVE-2026-108539 | 6.3 MEDIUM | GPAC MP4Box filter_queue.c gf_fq_pop use after free |
| CVE-2026-108770 | 5.3 MEDIUM | Appwrite Browser Screenshot Service Get.php PublicHostname server-side request forgery |
| CVE-2026-108572 | 4.3 MEDIUM | Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery |
IV. Related Vulnerabilities
Same product: GPAC
-
CVE-2026-108539
GPAC MP4Box filter_queue.c gf_fq_pop use after free -
CVE-2026-103227
GPAC DASH Client dash_client.c gf_dash_resolve_url buffer ov -
CVE-2026-93331
GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt o -
CVE-2026-92475
GPAC downloader.c wait_for_header_and_parse out-of-bounds -
CVE-2026-92474
GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use a
Same vendor: n/a
-
CVE-2026-108958
TensorLayer HDF5 Loading utils.py load_hdf5_graph deserializ -
CVE-2026-108836
Ollama Pull API name.go IsValid server-side request forgery -
CVE-2026-108829
Zen Cart Module Configuration modules.php sql injection -
CVE-2026-108828
Zen Cart Admin Panel configuration.php eval sql injection -
CVE-2026-108827
Zen Cart Administrative Module Management general.php zen_ca
Same weakness: CWE-416
-
CVE-2026-19938
Use-after-free of an ATT PDU buffer when signing an outgoing -
CVE-2026-85965
Use-after-free in Progress MarkLogic Server JavaScript engin -
CVE-2026-109268
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use Aft -
CVE-2026-109254
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Discon -
CVE-2026-108094
Mutter: mutter: client-triggered use-after-free in wayland c
V. Comments for CVE-2026-108538
No comments yet